Rating: 
Summary: Superficial
Review: All of the advice is way too high-level. You can get a much better overview of the issues with the other excellent books out there, such as Building Secure Software, Writing Secure Code or the Secure Programming for Linux and Unix HOWTO (which is free... see dwheeler.com). Here's an example of how superficial the advice here is. There's two short paragraphs on man-in-the-middle attacks. The explanation equates them with eavesdropping, and doesn't clearly explain that these attacks are still incredibly common in systems that make use of cryptography. In fact, the suggestion for remediation is little more than "use cryptographic authentication" which isn't nearly detailed enough advice to get it right. They give another option as "use ssh", which is a solution for sysadmins who might be hacking together a script not for real developers (particularly since this doesn't work well with Windows). "Use SSL" would still be too superficial, but at least be a lot better. All throughout the book things are this superficial.
Rating: 
Summary: Changes the way you write a program
Review: Authors explained on how to write secure coding without concentrating on technology or one language, they explained the entire concepts in general which can be implemented in whatever the language you develop your program. As the book says, you don't need to make the same mistake what others did, you learn from their mistakes. Reading this book changes the way you write your programs. If everbody implements secure coding, then will have less bugs in the software resulting less patches to install. Now a days we are finding lot of security updates because of not developing Secure applications.They tried to explain everything in simple but few topics went over my head, hope I need to concentrate on those topics over and over. I recommend this book for every one involved in IT projects, not the just developers.
Rating:
Summary: What every coder should read before programming
Review: Graff and van Wyk's book is great for both an IT manager to get up to speed quickly on security concepts as well as for a coder who needs checklists and case studies to learn from. Don't be deceived by its few pages, this book leaves out the fluff, but concentrates heavily on real-world security issues and problems. Because it abstracts the attacks and does not get bogged down in one particular implementation, Secure Coding is perfect for most any platform. I highly recommend this book for anyone (and that should be everyone) who needs critical computer security information. This book covers buffer overflows (and how to quickly fix them), race conditions, XSS, DOS attacks, security architecture, "good security" practices and much more. Think you're already in the know? Here's a test: Do you know why
char * buf=(char *) calloc(BUFSIZE,1);
is not always the best way to clear memory? Read the book to find out why! (page 66-67) Happy secure coding!
Rating:
Summary: If you manage coders, read this book
Review: In information security there are books about things and books on how to do things, this is a book *about* things. Secure coding doesn't tell you how to write secure code, the purpose is to you a clear understanding of the enviornment needed to ensure application development is being done in a sane and robust way. I was a bit nervous when one of the authors asked me to do a review of this book; I had just finished reviewing Inside Java, a masterpiece, but a tough read with a code example on every other page. Secure Coding is almost the polar opposite. There are only a couple examples of actual code. Instead the book weighs in at less than 200 content pages and is very approachable. If you are responsible for managing software developers, then you should buy this book, read this book and make certain you understand what it teaches! This will prepare you for serious discussions with your coders and give you the questions to ask to ensure they are using good practice.
Rating:
Summary: Holistic Security
Review: In the 11th century, Moses Maimonides taught us that the highest form of charity is to teach a man to fish. If you give him a fish, he can eat today. If you teach him to fish he can eat forever. In the same way, Mark G. Graff and Kenneth R. van Wyk have provided an excellent book that gives us a framework for thinking about security rather than trying to give specific rules that might have been invalid before the book came off the press. "Secure Coding" gives the reader the ability to envision, architect, design, code, and implement a security framework that truly meets the needs of its stakeholders. The authors don't provide a cookbook. In their own words: "When you picked up this book, perhaps you thought that we could provide certain security? Sadly, no one can." Instead, they deliver a robust mental model and a framework to understand security and to architect, design, develop, and operate secure systems. They present best practices in the field of security, the reasons for using them, and suggestions on deciding which practices are appropriate in your particular case. Their approach is to realize that the objective is not to make a system totally secure, but to make it just secure enough. Deciding what is "just secure enough" is a business and not a technical decision. It is based on weighing risk versus cost. There are substantial references throughout the book as well as an appendix of resources. The book is filled with examples of security failures and, more importantly, an excellent post mortem on each to show what could have been done to avoid the problem. The authors are extremely familiar with UNIX environments and this comes through in the examples. However, you don't need to be a UNIX guru to glean valuable lessons from the examples. One key message is that security is not something you can bolt onto an application. You must take a holistic approach to the overall system in which the application is being used. It's worth noting that many secure applications become extremely insecure because of the system environment (including networks) in which they exist. A second key message is that, while you can retrofit a insecure application, it is far easier and far less costly to incorporate security as an integral part of the entire development life-cycle including requirements, architecture, and design. The security architecture and design must be well-documented so that future maintenance does not inadvertently introduce gaping security holes. The book is primarily intended for those who architect, design, and code secure applications. However, I believe that it is a must read for those who manage and those who implement secure applications and systems.
Rating: 
Summary: Required reading for programmers serious about security
Review: In the movie Seabiscuit, the titular racehorse doesn't appear on screen until almost an hour into the movie. Nevertheless, the wait is worth it, and the movie was a blockbuster. While no one would confuse this uplifting Depression-era tale with a book on computer code, Secure Coding shares a basic similarity with Seabiscuit: The former doesn't trot out its subject--an actual piece of software code--until page 76, and the result is outstanding nonetheless. The similarity ends there. While moviegoers eagerly awaited Seabiscuit's appearance, security professionals might well dread the first appearance of code. Refreshingly, the book contains only seven pages of software code. Similarly themed books spend most of their time in the nitty-gritty of actual code. This one is a horse of a different color, dealing with what needs to be done before the first line of software code is actually written. With the goal of helping developers create applications that are resilient against attacks, the authors develop the book around three categories of software development: architecture and design, implementation, and operations. Above and beyond technical aspects of software development, the authors describe how serious security vulnerabilities leak into the software-development process. These include ignorance, psychological issues, and the short time spans allotted to the development process. This book is a sure bet to help developers and project managers create secure software applications without bogging down in specific code.
Rating:
Summary: Van Wyk and Graff deliver the playbook for Security
Review: Ken and Mark have written the playbook for writing secure code. The book focuses on security principles and doesn't use complicated code-based examples to explain these essential security practices. The authors use very easy-to-understand examples that help to illustrate the security principles they discuss. Step-by-step, they take readers through the levels of security from the initial architecture right through to the QA process. These practices and examples are not the product of reading what someone else wrote and regurgitating it in another form (as so often security publications are these days) but rather the product of experience, and mistakes. That is truly where this book's value rests. This book is truly a triumph in security. With a combination of good examples and well thought-out text, this book is a must read. My only criticism of the book is that people might dismiss it as a coder's guide books by the title. The book is not just for coders, its for anyone involved in anyway with computer security.
Rating:
Summary: Just plain good
Review: My job is fixing security vulnerabilities in applications. This book offers a great description of how to creat applications that don't need fixing. It should be required reading for anyone involved in the world of software creation - from management to coders. The content is well explained, engaging and clearly written. A good job well done!
Rating:
Summary: Secure Coding: Logico Philosophicus
Review: Secure Coding is not a "technical" book, at least not in the traditional sense of the term. It is a psychological and philosophical masterpiece that just happens to address technical issues at the same time. It delves deep into the human psyche and attempts to explain HOW and WHY developers write insecure code, and what we can do to avoid such mistakes. Furthermore, it dispels widely-held cognitive distortions associated with software design and secure coding. This book is of paramount importance to the industry, and should be read by anyone and everyone involved in software development. Personally, I will not be placing my copy of Secure Coding among the countless other O'Reilly books in my library, as it transcends the technical genre. Instead, I've found a nice little spot for it next to Plato's The Republic and Hume's Treatise of Human Nature. Yes, it's that good.
Rating:
Summary: Some reviewers missing the point.
Review: Some of the reviewers here are missing the point of this book. It's not a "secure code cookbook" in that it doesn't give specific code examples. Such things are quickly obsolete anyway. This book teaches you how to *think* about security, how to think about and *design* code that will be secure. It isn't a "add this snippit of code to your input buffer validation function" sort of book. There are many of these books, and they're useful in their place, but this book writes about the design of secure code, not the actual specifics. To continue the cooking analogy, this is a book on how to write receipes, not a book *of* receipes. Disclaimer, I helped review this book - and I think it's the sort of work that has been sorely missing in the field (I was also given a free copy for doing the review work). Jeremy Allison,
Samba Team.
| 
