The 19 Deadly Sins of Software Security

Chapter 1: Buffer Overflows; Chapter 2: Format String Problems; Chapter 3: SQL Injection; Chapter 4: Command Injection; Chapter 5: Failure to Handle Errors; Chapter 6: Cross-Site Scripting; Chapter 7: Failing to Protect Network Traffic; Chapter 8: Use of "Magic" URLs and Hidden Forms; Chapter 9: Improper Use of SSL; Chapter 10: Use of Weak Password-Based Systems; Chapter 11: Failing to Store Data Securely; Chapter 12: Hard Coding Secrets; Chapter 13: Improper File Access; Chapter 14: Integer Range Errors; Chapter 15: Trusting Network Address Information; Chapter 16: Signal Race Conditions; Chapter 17: Unauthenticated Key Exchange; Chapter 18: Failing to Use Cryptographically Strong Random Numbers; Chapter 19: Poor Usability.

Michael Howard is a principal security program manager on the Trustworthy Computing Group s Security Engineering team at Microsoft. He is the author or coauthor of many well-known software security books and is an editor of i IEEE Security & PrivacyDavid LeBlanc, Ph.D., is a principal software development engineer on the Microsoft Office security team. He is a coauthor, with Michael Howard, of Writing Secure Code (Microsoft Press).John Viega, the founder and CEO of Stonewall Software, is a well-known security expert and the coauthor of Building Secure Software (Addison-Wesley) and Network Security with OpenSSL (O'Reilly). John is responsible for numerous software security tools and is the original author of Mailman, the GNU mailing list manager. He holds a B.A. and M.S. in computer science from the University of Virginia. John is also an adjunct professor of Computer Science at Virginia Tech (Blacksburg) and is a senior policy researcher at the Cyberspace Policy Institute. He serves on the technical advisory board
for the Open Web Applications Security Project. He also founded a Washington, D.C.-area security interest group that conducts monthly lectures presented by leading experts in the field. He is the author or coauthor of nearly 80 technical publications, including numerous refereed research papers and trade articles.