Introduction |
|
xxi | |
|
Part I What You Must Know to Write Code Safe Enough to Put on the Internet |
|
|
1 | (118) |
|
Chapter 1 Security Fundamentals |
|
|
3 | (18) |
|
The Security Mandate: CIA |
|
|
3 | (4) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
5 | (2) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
9 | (2) |
|
|
11 | (1) |
|
|
11 | (2) |
|
|
13 | (1) |
|
|
14 | (1) |
|
|
15 | (1) |
|
Never Trust, Always Verify |
|
|
15 | (2) |
|
|
17 | (1) |
|
Factors of Authentication |
|
|
18 | (2) |
|
|
20 | (1) |
|
Chapter 2 Security Requirements |
|
|
21 | (44) |
|
|
22 | (20) |
|
|
23 | (1) |
|
|
24 | (4) |
|
|
28 | (1) |
|
|
29 | (2) |
|
Security Headers: Seatbelts for Web Apps |
|
|
31 | (1) |
|
Security Headers in Action |
|
|
32 | (1) |
|
|
32 | (1) |
|
Content-Security-Policy (CSP) |
|
|
32 | (3) |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
36 | (1) |
|
Strict-Transport-Security (HSTS) |
|
|
37 | (1) |
|
|
38 | (1) |
|
X-Permitted-Cross-Domain-Policies |
|
|
39 | (1) |
|
|
39 | (2) |
|
Public Key Pinning Extension for HTTP (HPKP) |
|
|
41 | (1) |
|
|
42 | (4) |
|
|
42 | (1) |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
43 | (1) |
|
|
44 | (1) |
|
|
44 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
|
45 | (1) |
|
Passwords, Storage, and Other Important Decisions |
|
|
46 | (8) |
|
|
52 | (1) |
|
|
53 | (1) |
|
|
54 | (1) |
|
|
54 | (1) |
|
Framework Security Features |
|
|
54 | (1) |
|
Technical Debt = Security Debt |
|
|
55 | (1) |
|
|
56 | (1) |
|
|
57 | (1) |
|
Input Validation and Sanitization |
|
|
58 | (1) |
|
Authorization and Authentication |
|
|
59 | (1) |
|
|
59 | (1) |
|
|
60 | (1) |
|
|
60 | (1) |
|
|
61 | (2) |
|
|
63 | (2) |
|
|
65 | (18) |
|
Design Flaw vs. Security Bug |
|
|
66 | (2) |
|
|
67 | (1) |
|
|
68 | (1) |
|
|
68 | (9) |
|
Protecting Sensitive Data |
|
|
68 | (2) |
|
Never Trust, Always Verify/Zero Trust/Assume Breach |
|
|
70 | (1) |
|
|
71 | (2) |
|
Server-Side Security Validation |
|
|
73 | (1) |
|
Framework Security Features |
|
|
74 | (1) |
|
Security Function Isolation |
|
|
74 | (1) |
|
|
75 | (1) |
|
|
76 | (1) |
|
Re-authentication for Transactions (Avoiding CSRF) |
|
|
76 | (1) |
|
Segregation of Production Data |
|
|
77 | (1) |
|
Protection of Source Code |
|
|
77 | (1) |
|
|
78 | (4) |
|
|
82 | (1) |
|
|
83 | (22) |
|
Selecting Your Framework and Programming Language |
|
|
83 | (4) |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
86 | (1) |
|
Programming Languages and Frameworks: The Rule |
|
|
87 | (1) |
|
|
87 | (2) |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
91 | (2) |
|
|
93 | (1) |
|
|
94 | (2) |
|
|
96 | (3) |
|
Error Handling, Logging, and Monitoring |
|
|
99 | (4) |
|
|
100 | (1) |
|
|
100 | (1) |
|
|
101 | (2) |
|
|
103 | (2) |
|
Chapter 5 Common Pitfalls |
|
|
105 | (14) |
|
|
105 | (4) |
|
Defenses and Vulnerabilities Not Previously Covered |
|
|
109 | (6) |
|
Cross-Site Request Forgery |
|
|
110 | (2) |
|
Server-Side Request Forgery |
|
|
112 | (2) |
|
|
114 | (1) |
|
|
115 | (2) |
|
|
117 | (1) |
|
|
117 | (2) |
|
Part II What You Should Do to Create Very Good Code |
|
|
119 | (74) |
|
Chapter 6 Testing and Deployment |
|
|
121 | (30) |
|
|
121 | (8) |
|
|
122 | (1) |
|
Static Application Security Testing (SAST) |
|
|
123 | (2) |
|
Software Composition Analysis (SCA) |
|
|
125 | (1) |
|
|
126 | (2) |
|
Infrastructure as Code (IaC) and Security as Code (SaC) |
|
|
128 | (1) |
|
|
129 | (12) |
|
|
130 | (1) |
|
|
131 | (1) |
|
|
131 | (1) |
|
|
132 | (1) |
|
|
133 | (1) |
|
Dynamic Application Security Testing (DAST) |
|
|
133 | (2) |
|
VA/Security Assessment/PenTest |
|
|
135 | (6) |
|
Testing Your Infrastructure |
|
|
141 | (1) |
|
|
141 | (1) |
|
Testing Your APIs and Web Services |
|
|
142 | (1) |
|
Testing Your Integrations |
|
|
143 | (1) |
|
|
144 | (1) |
|
|
145 | (4) |
|
Editing Code Live on a Server |
|
|
146 | (1) |
|
|
146 | (1) |
|
"Homemade" Deployment Systems |
|
|
147 | (1) |
|
|
148 | (1) |
|
Contiguous Integration/Continuous Delivery/Continuous Deployment |
|
|
148 | (1) |
|
|
149 | (2) |
|
Chapter 7 An AppSec Program |
|
|
151 | (16) |
|
Application Security Program Goals |
|
|
152 | (10) |
|
Creating and Maintaining an Application Inventory |
|
|
153 | (1) |
|
Capability to Find Vulnerabilities in Written, Running, and Third-Party Code |
|
|
153 | (1) |
|
Knowledge and Resources to Fix the Vulnerabilities |
|
|
154 | (1) |
|
Education and Reference Materials |
|
|
155 | (1) |
|
Providing Developers with Security Tools |
|
|
155 | (1) |
|
Having One or More Security Activities During Each Phase of Your SDLC |
|
|
156 | (1) |
|
Implementing Useful and Effective Tooling |
|
|
157 | (1) |
|
An Incident Response Team That Knows When to Call You |
|
|
157 | (2) |
|
Continuously Improve Your Program Based on Metrics, Experimentation, and Feedback |
|
|
159 | (1) |
|
|
159 | (2) |
|
|
161 | (1) |
|
Feedback from Any and All Stakeholders |
|
|
161 | (1) |
|
A Special Note on DevOps and Agile |
|
|
162 | (1) |
|
Application Security Activities |
|
|
162 | (2) |
|
Application Security Tools |
|
|
164 | (2) |
|
Your Application Security Program |
|
|
165 | (1) |
|
|
166 | (1) |
|
Chapter 8 Securing Modern Applications and Systems |
|
|
167 | (26) |
|
|
168 | (3) |
|
|
171 | (1) |
|
Containers and Orchestration |
|
|
172 | (2) |
|
|
174 | (1) |
|
Infrastructure as Code (IaC) |
|
|
175 | (2) |
|
|
177 | (1) |
|
Platform as a Service (PaaS) |
|
|
178 | (1) |
|
Infrastructure as a Service (IaaS) |
|
|
179 | (1) |
|
Continuous Integration/Delivery/Deployment |
|
|
180 | (1) |
|
|
180 | (3) |
|
|
182 | (1) |
|
|
183 | (2) |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
185 | (1) |
|
|
186 | (3) |
|
IAST Interactive Application Security Testing |
|
|
186 | (1) |
|
Runtime Application Security Protection |
|
|
187 | (1) |
|
File Integrity Monitoring |
|
|
187 | (1) |
|
Application Control Tools (Approved Software Lists) |
|
|
187 | (1) |
|
Security Tools Created for DevOps Pipelines |
|
|
188 | (1) |
|
Application Inventory Tools |
|
|
188 | (1) |
|
Least Privilege and Other Policy Automation |
|
|
189 | (1) |
|
|
189 | (2) |
|
|
191 | (1) |
|
|
191 | (2) |
|
Part III Helpful Information on How to Continue to Create Very Good Code |
|
|
193 | (32) |
|
|
195 | (12) |
|
|
196 | (3) |
|
Remove Password Complexity Rules |
|
|
196 | (1) |
|
|
197 | (1) |
|
|
198 | (1) |
|
|
198 | (1) |
|
Do Not Implement Password Rotation |
|
|
199 | (1) |
|
Multi-Factor Authentication |
|
|
199 | (1) |
|
|
200 | (1) |
|
|
201 | (1) |
|
|
202 | (1) |
|
|
202 | (1) |
|
|
203 | (1) |
|
|
204 | (2) |
|
|
204 | (1) |
|
|
204 | (1) |
|
|
204 | (1) |
|
|
205 | (1) |
|
|
206 | (1) |
|
|
206 | (1) |
|
Chapter 10 Continuous Learning |
|
|
207 | (10) |
|
|
208 | (6) |
|
|
208 | (1) |
|
|
208 | (1) |
|
|
209 | (1) |
|
|
209 | (3) |
|
|
212 | (1) |
|
|
213 | (1) |
|
|
214 | (1) |
|
|
214 | (2) |
|
|
216 | (1) |
|
Chapter 11 Closing Thoughts |
|
|
217 | (8) |
|
|
218 | (5) |
|
When Have You Done Enough? |
|
|
218 | (2) |
|
How Do You Get Management on Board? |
|
|
220 | (1) |
|
How Do You Get Developers on Board? |
|
|
221 | (1) |
|
|
222 | (1) |
|
|
223 | (1) |
|
|
223 | (2) |
|
|
225 | (8) |
|
|
225 | (1) |
|
Chapter 1 Security Fundamentals |
|
|
225 | (1) |
|
Chapter 2 Security Requirements |
|
|
226 | (1) |
|
|
227 | (1) |
|
|
228 | (1) |
|
Chapter 5 Common Pitfalls |
|
|
228 | (1) |
|
Chapter 6 Testing and Deployment |
|
|
229 | (1) |
|
Chapter 7 An AppSec Program |
|
|
229 | (1) |
|
Chapter 8 Securing Modern Applications and Systems |
|
|
230 | (1) |
|
|
231 | (1) |
|
Chapter 10 Continuous Learning |
|
|
231 | (2) |
|
|
233 | (16) |
|
Chapter 1 Security Fundamentals |
|
|
233 | (2) |
|
Chapter 2 Security Requirements |
|
|
235 | (1) |
|
|
236 | (2) |
|
|
238 | (3) |
|
Chapter 5 Common Pitfalls |
|
|
241 | (1) |
|
Chapter 6 Testing and Deployment |
|
|
242 | (2) |
|
Chapter 7 An AppSec Program |
|
|
244 | (1) |
|
Chapter 8 Securing Modern Applications and Systems |
|
|
245 | (2) |
|
|
247 | (1) |
|
Chapter 10 Continuous Learning |
|
|
248 | (1) |
Index |
|
249 | |