The Art of Software Security Testing: Identifying Software Security Flaws

This is a good "short" version of "The Art of Software Security Assessment" by Dowd. For a security book its short, at 250 pages. The book contains useful information but not enough to be an expert at anything. This is definitely one of those mile wide, inch deep books and not a one stop shop as it says in the preface. It covers topics in enough detail to have heard of the issue and some of the chapters give you some links to further information but you wont come away with enough knowledge to actually do many of the attacks talked about. It does hit the major attack vectors; Ch6 Generic Network Fault Injection, Ch7 Web Applications: Session Attacks, Ch8 Web Applications: Common Issues, Ch9 Web Proxies: Using WebScarab, Ch10 Implementing a Custom Fuzz Utility, and Ch11 Local Fault Injection. So thats a plus. The first part of the book on Secure Software Development Lifecycle was good, but again, not really enough information to be the only book you need on the subject. The third part of the book on analysis, Ch12 Determining Exploitability, was really not useful to me its way too short and tries to cram exploit development into 25 pages which just isn't possible. It shows you some diagrams of the stack and heap then some winDbg screen shots of nameless programs crashing and overwriting EIP (stack) and EAX (heap) and a null dereference. Fairly anti-climatic and doesn't dispel the "magic" of writing exploits. Things I liked; the WebScarab chapter (Ch9) was good, that can be a tough tool to get up and running with all of its options. The Web Application chapters (Ch 7 & Ch8) are pretty good overviews. Part 1 of the book on the SSDL, overview of how vulnerabilities get into code, and risk-based security testing was useful to me and serves as a good into to the Dowd book. Things I didn't like; Chapter 12 on Determining Exploitability was too short and not enough information, no code for the custom web application they use for examples for SQL Injection. I'm very much a "have to do it" guy and not having the code was a disappointment and lastly the book's website seems to have never been updated after first standing it up. I'd recommend the book to people who need to get an idea of security flaws, how they get into code and some visual examples of those flaws. But only if they needed either a high level overview or they need an initiation to the topic. For people who need a deep knowledge I'd refer them to the Dowd book.

This review refers to the 2007 edition of "The Art of Software Security Testing" by Wysopal, Nelson, Zovi, & Dustin. I highly recommend this as a primer for anyone interested in software security testing. First, it is up-to-date. In a very useful discussion the book points out that the nature of attacks and attackers have changed considerably in recent years. Methods for protecting oneself must change accordingly. The book is brief, comprehensive, and generally well written. One finds a goodly amount of practical information to get started. More importantly, one gets a broad understand of the primary areas of interest acting as a guide for further study. Everything is touched upon in sufficient detail for a book of this type. Part I covers the genesis of security defects, the Secure Software Development Lifecycle (SSDL), and Threat Modeling. Part II covers common types of attacks and how to test for them, including Network Fault Injection, Web Application Session Attacks, and SQL Injection. Part III covers stack and heap overflows and how to assess their exploitability. Many of the topics covered deserve volumes of their own such as Threat Modeling (Microsoft Professional), Exploiting Software: How to Break Code (Addison-Wesley Software Security Series), and The Security Development Lifecycle. But this book will give you lay of the land and enough knowledge to get started on security testing right away. The book misses 5 stars because it becomes difficult to follow in places. The book attempts to cover both Windows and UNIX/Linux systems, and occasionally confuses the two, at least in the mind of the reader. One example is the section on "Port Discovery" where the authors discuss similar and completely different UNIX and Windows tools in a confusing interleaved fashion. It would have been wiser to separate the discussion of Windows and UNIX systems into discrete sections. That said, I highly recommend the book as a primer on security testing for it's coverage, brevity, and up-to-date information.

"The Art of Software Security Testing" is the first security testing book I read that includes a reputable software tester (Elfriede Dustin) among its authors. This should lend the book instant credibility with its main target audience: testers and QA engineers. The security proficient readers will be happy to know that the main author is Chris Wysopal, one of the members of the famous L0pht Heavy Industries security research group who testified before the US Senate that it is possible and indeed within their power to "take down the Internet in 30 minutes". Most security testing books adopt a black-box approach, detailing security assessment and penetration testing techniques that view the "victim" -- be it a device, an operating system or an application -- as an unknown quantity (or should I say quality, since we're talking about testing) that is probed and attacked from the outside in. A few books adopt a white-box approach, teaching code inspection and secure coding techniques, viewing the software from the inside out. "The Art of Software Security Testing" is a fortunate blend of the two approaches, teaching its readers how to conduct what is called "gray-box testing", which is of course what you get when you combine black and white. When it comes to assessing the security of an application, testers have one important advantage over outside attackers: they can collaborate with the designers and developers of the application and get an insider view of what the book repeatedly refers to as "the attack surface", basically the list of all the inputs and resources used by the program under test. Armed with this knowledge, testers can then apply a wealth of techniques that attempt to break the security of the application, and that can be summarized in two words: fault injection. Indeed, the bulk of the book is devoted to the presentation of techniques and tools that assist testers as they try to make the application fail by feeding it various types of inputs (hence the term fault injection). These inputs range from carefully crafted strings used in SQL Injection attacks, to random byte changes in given input files, to random strings fed as command line arguments. Two important classes of fault injection tools discussed throughout the book are proxies (such as WebScarab) which allow the attacker to intercept and modify traffic to and from the application under test, and fuzzers (such as CLI Fuzz) which allow the attacker to inject random inputs into the application. As an aside, I liked the fact that the authors discuss mostly freely available Open Source tools. If you are a tester trying to assess the security of an application, a developer trying to improve the security of your code, or even if you are a seasoned security practitioner trying to learn new ways to attack software, this book is for you. I, as a tester, found valuable advice right in Chapter 1: act as a detective by applying the fault injection model, think as an attacker, prioriti

This book should be read by everyone in a position of responsibility for developing, testing and/or implementing a software application. The paradigm shift in thinking outlined in The Art of Software Security Testing has been needed in the application security area for sometime. This shift includes a focus on disciplined approaches to performing security requirements definition, secure software development and responsive security testing, where the greatest vulnerabilities exist. Instead of security C & A teams preparing documents and checking boxes, a leadership role is needed within organizations to modify application development with an emphasis on security throughout the software development lifecycle from security requirements definition through structured security testing. Finally a book that effectively articulates the actions we all need to perform for securing applications and building secure applications. This book is written at the right technical level and provides guidance to industry and government professionals who must deliver real projects under considerable schedule pressure. Jeff Rashka Director of Applications US Federal Highway Administration