Crafting Secure Software

Name: Crafting Secure Software | An engineering leader's guide to security by design
Brand: Packt Publishing
Price: 29.99 EUR
Availability: OnlineOnly

An engineering leader's guide to security by design

Greg Bulmash Thomas Segura(Autor*in)

Packt Publishing

1. Auflage

Erschienen am 12. September 2024

156 Seiten

E-Book

ePUB mit Adobe-DRM

Systemvoraussetzungen

978-1-83588-507-9 (ISBN)

29,99 €inkl. 7% MwSt.

Systemvoraussetzungen

für ePUB mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Cover
Table of Contents
Preface
Chapter 1: Introduction to the Security Landscape
The evolving application security landscape
Security awareness
Regulatory compliance and legal considerations
Who are the threat actors?
Supply chain attack case: SolarWinds
Where GitGuardian stands in the landscape
Summary
Chapter 2: The Software Supply Chain and the SDLC
What is the software supply chain?
What is the software development life cycle?
The intersection of SDLC and SSC
SDLC stages and SSC considerations
Trustworthiness in the software supply chain
Common supply chain attack vectors and defenses
Compromise of third-party components
Supply chain poisoning via updates
Insufficient security practices in development and operations
Code repository tampering
Threat modeling
Decompose the application
Determine and rank threats
Risk assessment
Integrating risk assessment to rank the threats
Threat modeling and risk assessment: How do they differ?
Real-world SSC attacks
PHP: No harm, but foul
3CX: Compromised build servers deliver malware to hundreds of thousands
Log4j: The undependable dependency
left-pad: Many introduced to supply chain attacks
Summary
Chapter 3: Securing Your Code-Writing Tools
Securing your IDE
Issues with the IDE itself
Issues with IDE plugins
Use case: Hardening Visual Studio Code
Securing your VCS and SCM
Access and rights
Integrating security tools
Securing built-in CI/CD tools
Be sure and intentional about "which" does "what
Use secrets management
Mask confidential information
Benefits and dangers of LLM-generated code
IP concerns and lack of provenance
Challenges and risks of using AI-generated code
Sensitive data leakage
Summary
Chapter 4: Securing Your Secrets
What are secrets?
One service, multiple secrets
Secrets in code
How do secrets end up in code?
How do you detect secrets in code?
How do you remediate a leaked secret?
Common mistakes in remediating leaked secrets
Considerations in the revoke and reissue workflow
How do you prevent secrets in code?
Secrets in tools
How do secrets end up in tools?
How do you detect secrets in tools?
How do you remediate a leaked secret?
How do you prevent secrets in tools?
Secrets in artifacts
How do secrets end up in artifacts?
How do you detect secrets in artifacts?
How do you remediate a leaked secret?
How do you prevent secrets in artifacts?
The importance of identity and access management (IAM)
Machine identities
Summary
Chapter 5: Securing Your Source Code
Package managers and repositories
How are they made vulnerable?
Testing SAST, DAST, and SCA
Why testing is important
Understanding SAST
Understanding DAST
Understanding SCA
Scanning for secrets
Creating and reading an SBOM
What is an SBOM, and why you need one
SBOM formats
How to use an SBOM from a supplier
How to create an SBOM for your customers
Think like a hacker: Ethical hacking
What makes ethical hacking "ethical"?
Offering a "bug bounty"
Summary
Chapter 6: Securing Your Delivery
What are build pipelines?
Why secure CI/CD pipelines?
Where are the threats to build pipelines?
Securing build pipelines
Stage 1: Git workflow
Stage 2: Build configuration
Securing containers and artifacts
Securing build steps
The SLSA framework
Artifact signing
Leveraging Sigstore in cloud pipelines
Securing your delivery
Project Spinnaker
Securing deployments
Infrastructure as code
Identity, secrets, and access management
Managing human and machine identities
Proactively detecting and rotating exposed secrets
Using honeytokens to detect intrusions and leaked secrets
Zero-trust networking
Summary
Chapter 7: Security Compliance and Certification
What are legislators and regulators concerned about?
Security
Data privacy
Transparency and control
What are they demanding, and how can you address it?
Protect your code and systems access
Monitor employee communications and activity
Observe best physical security practices
Encrypt everything
Disclosure, consent, and control
Transparency
Security frameworks
NIST CSF
NIST SSDF
OWASP
PCI DSS
SLSA
Proving you're taking the right steps: Certification
Proving it to customers and partners
Proving it to regulators
Summary
Chapter 8: Best Practices to Drive Security Buy-In
Best practices to create a robust security defense
Get a clear picture of the current state
Don't rely on compliance with security standards and regulations
Leverage real threats for strategic improvements
Understand and engage your stakeholders
Assess security awareness
Communicate effectively
Foster a security culture
Align security goals with business outcomes
ROI in cybersecurity
Annualized Loss Expectancy
Key takeaways
Success stories
A top US telecom provider reduced real-time secret incidents by 72%
An e-commerce company cut risk by 75% and boosted security team productivity by 50%
Summary
Appendix: Glossary of Acronyms and Abbreviations
Index
Other Books You May Enjoy

Systemvoraussetzungen

Als PDF speichern Als Link merken