42%
Alice and Bob Learn Secure Coding

Alice and Bob Learn Secure Coding

          
5
4
3
2
1

International Edition


Premium quality
Premium quality
Bookswagon upholds the quality by delivering untarnished books. Quality, services and satisfaction are everything for us!
Easy Return
Easy return
Not satisfied with this product! Keep it in original condition and packaging to avail easy return policy.
Certified product
Certified product
First impression is the last impression! Address the book’s certification page, ISBN, publisher’s name, copyright page and print quality.
Secure Checkout
Secure checkout
Security at its finest! Login, browse, purchase and pay, every step is safe and secured.
Money back guarantee
Money-back guarantee:
It’s all about customers! For any kind of bad experience with the product, get your actual amount back after returning the product.
On time delivery
On-time delivery
At your doorstep on time! Get this book delivered without any delay.
Quantity:
Add to Wishlist

About the Book

Unlock the power of secure coding with this straightforward and approachable guide! Discover a game-changing resource that caters to developers of all levels with Alice and Bob Learn Secure Coding. With a refreshing approach, the book offers analogies, stories of the characters Alice and Bob, real-life examples, technical explanations and diagrams to break down intricate security concepts into digestible insights that you can apply right away. Explore secure coding in popular languages like Python, Java, JavaScript, and more, while gaining expertise in safeguarding frameworks such as Angular, .Net, and React. Uncover the secrets to combatting vulnerabilities by securing your code from the ground up! Topics include: Secure coding in Python, Java, Javascript, C/C++, SQL, C#, PHP, and more Security for popular frameworks, including Angular, Express, React, .Net, and Spring Security Best Practices for APIs, Mobile, Web Sockets, Serverless, IOT, and Service Mesh Major vulnerability categories, how they happen, the risks, and how to avoid them The Secure System Development Life Cycle, in depth Threat modeling, testing, and code review The agnostic fundamentals of creating secure code that apply to any language or framework Alice and Bob Learn Secure Coding is designed for a diverse audience, including software developers of all levels, budding security engineers, software architects, and application security professionals. Immerse yourself in practical examples and concrete applications that will deepen your understanding and retention of critical security principles. Alice and Bob Learn Secure Coding illustrates all the included concepts with easy-to-understand examples and concrete practical applications, furthering the reader’s ability to grasp and retain the foundational and advanced topics contained within. Don't miss this opportunity to strengthen your knowledge; let Alice and Bob guide you to a secure and successful coding future.

Table of Contents:
Foreword xxvii  Introduction xxix  Part I General Advice 1  Chapter 1 Introductory Security Fundamentals 3  Assume All Other Systems and Data Are Insecure 3  The CIA Triad 4  Least Privilege 6  Secure Defaults/Paved Roads 8  Assume Breach / Plan For Failure 9  Zero Trust 9  Defense in Depth 10  Supply Chain Security 10  Security by Obscurity 11  Attack Surface Reduction 11  Usable Security 12  Fail Closed/Safe, Then Roll Back 12  Compliance, Laws, and Regulations 12  Security Frameworks 14  Learning from Mistakes and Sharing Those Lessons 16  Backward Compatibility (and Potential Risks It Introduces) 16  Threat Modeling 16  The Difficulty of Patching 17  Retesting Fixes for New Security Bugs 18  Chapter Exercises 19  Chapter 2 Beginning 21  Follow a Secure System Development Life Cycle 21  Use a Modern Framework and All Available Security Features Within 22  Input Validation 23  Output Encoding 26  Examples of Output Encoding 27  HTML Context 28  JavaScript Context 28  Parameterized Queries and ORMs 29  Authentication and Identity 31  Authorization and Access Control 32  Access Control Models 33  Logical Access Control Methods (Implementation) 34  Session Management 34  Secret Management 35   Password Management 37  Communication Security (Cryptography and HTTPS Only) 39  Protecting Sensitive Data 40  Security Headers 43  New Security Header Features 43  Fetch Metadata Request Headers 43  Content Security Policy Header 44  Strict-Dynamic 44  Trusted-Types 44  Security Headers Previously Covered 44  Content-Security-Policy Header 45  HTTP Strict-Transport-Security 45  X-Frame-Options 45  X-Content-Type-Options 45  Permissions Policy 46  Expect-CT 46  Referrer-Policy 46  Public Key Pinning Extension for HTTP (HPKP) 46  X-XSS-Protection 46  More New Headers 46  Same-Origin Policy 47  COEP: Cross-Origin Embedder Policy 47  COOP: Cross-Origin Opener Policy 48  CORP: Cross-Origin Resource Policy 48  CORS: Cross-Origin Resource Sharing 48  CORB: Cross-Origin Read Blocking 49  Secure Cookies 50  Error Handling 51  Chapter Exercises 52  Chapter 3 Improving 55  Database Security 56  Four Perspectives for Protecting Databases 56  File Management 59  File Uploads 61  Your Source Code 62  Memory Management (Buffer, Stack, String, and Integer Overflows) 63  How Do We Avoid Overflows? 64  (De)Serialization 66  Privacy (User/Citizen/Customer/Employee) 67  Errors 69  Logging, Monitoring, and Alerting 72  Fail Closed 73  Locking Resources 73  Enabling Password Managers 74  Cryptographic Practices 75  Strongly Typed Languages 76  Strongly Typed Languages 76  Weakly Typed Programming Languages 77  Domain-Driven Development 78  Memory-Safe Languages 79  Chapter Exercises 80  Chapter 4 Achieving 81  Secure Design 82  How much is “enough” (design) security? 84  Dependency Management and Supply Chain Security 85  Dependency Security 86  Checking If Dependencies Are Safe to Use 87  Supply Chain Security 87  Secure Defaults 90  Secure Defaults for Users 90  Secure Defaults for Developers 92  Readable and Auditable Code 93  Important Functions Happen on Trusted Systems 96  What Is an “Untrusted” System? 96  What Are “Important Functions”? 97  Putting It Together 97  Allowlists versus Blocklists 97  Why Are Block Lists Bad? 98  How Do We Create an Allowlist? 98  Secure Configurations 99  Hostname Validation 100  Reusable Code 100  Safe System Calls 102  Mitigating Circumstances 102  Commenting and Other Documentation 102  Comments 103  Documentation 104  Verification of User Consent 106  Integrity Checks, Code Signing, and Immutable Builds 107  Immutable Builds 108  Avoiding Brute Force 109  Security Controls 110  Handling Elevated Privileges 111  Security Maintenance 112  Repaying Technical Debt 113  Chapter Exercises 114  Summary of Part I 117  Checklist of General Secure Coding Advice 117  Part II Specific Advice 125  Chapter 5 Technology-Specific 127  API Security Best Practices 127  Mobile Application Security Best Practices 134  WebSocket Security Best Practices 137  Serverless Security Best Practices 138  IoT Security Best Practices 140  Chapter Exercises 141  Chapter 6 Popular Programming Languages 143  JavaScript 143  Html/css 148  HTML5, Specifically 149  Python 151  Sql 154  Node.js 157  Java 160  Serialization in Java 164  TypeScript 165  C# 166  Php 170  C/c++ 175  Conclusion 178  Chapter Exercises 179  Chapter 7 Popular Frameworks 181  Web and JavaScript 181  Express 182  React.js 184  Angular 186  jQuery 190  Vue.js 192  Other Frameworks and Libraries 194  .NET (Core) 194  Ruby on Rails 199  Spring and Spring Boot 204  Flask 207  Chapter Exercises 210  Chapter 8 Vulnerability Categories 211  Design Flaws / Logic Flaws 212  How Does This Happen? 213  The Risk 213  Prevention 214  Code Bugs / Implementation Errors 215  How Does This Happen? 215  The Risk 215  Prevention 215  Overflows and Other Memory Issues 216  Overflows 216  Buffer Overreads 217  Invalid Page Faults 217  Use After Free 218  Uninitialized Variables 218  Memory Leaks 218  How Does This Happen? 219  The Risk 219  Prevention 219  Injection: Interpreter and Compiler Issues 220  How Does This Happen? 221  The Risk 221  Prevention 221  Input Issues 222  How Does This Happen? 223  The Risk 223  Prevention 223  Authentication and Identity Issues 223  How Does This Happen? 224  The Risk 224  Prevention 224  Authorization and Access Issues 225  How Does This Happen? 225  Configuration and Implementation Issues 225  How Does This Happen? 226  The Risk 226  Prevention 226  Fraudulent Transactions 227  How Does This Happen? 227  The Risk 227  Prevention 228  Replay Attacks 228  How Does This Happen? 228  The Risk 229  Prevention 229  Crossing Trust Boundaries 229  How Does This Happen? 230  The Risk 230  Prevention 230  File Handling Issues 230  How Does This Happen? 231  The Risk 231  Prevention 231  Object Handling Issues 232  Prominent Features of OOP 232  Deserialization and Other Object Handling Issues 234  How Does This Happen? 234  The Risk 234  Prevention 234  Secrets Management Issues 235  How Does This Happen? 236  The Risk 236  Prevention 236  Race Conditions and Timing Issues 237  How Does This Happen? 237  The Risk 238  Prevention 238  Resource Issues 240  How Does This Happen? 240  The Risk 241  Prevention 241  Falling into an Unknown State 241  How Does This Happen? 242  The Risk 242  Prevention 242  Chapter Exercises 243  Summary of Part II 245  Checklist of Technology-Specific Secure Coding Advice 245  Checklist of Secure Coding Advice for Languages and Frameworks 246  Summary of Vulnerability Issues to Watch For 248  Part III Secure System Development Life Cycle 251  Chapter 9 Requirements 253  Project Kick-Off: Outline of Your Project’s Security Activities 253  Project Scheduling and Planning 254   Security Requirements 255  Chapter Exercises 257  Chapter 10 Design 259  Threat Modeling 260  Secure Design Patterns and Concepts 262  Architecture Whiteboarding 263  Examining Data Flows 263  Security User Stories 264  Chapter Exercises 265  Chapter 11 Coding 267  Training 267  Organizations 269  Individuals 270  Code Review 270  First- and Second-Generation Static Analysis Tools 271  Secure Guardrails 272  IDE Plugins and Other Guidance 273  Verifying That Your Dependencies Are Safe (SCA) 274  How Do You Decide Which Dependencies Are Worth Updating or Changing? 274  Finding and Managing Secrets 275  Dynamic Testing (DAST) 276  Chapter Exercises 278  Chapter 12 Testing 279  Test Coverage and Timing 280  Depth Versus Coverage 281  Scanning Your Infrastructure 281  Production or Lower-Level Environments 281  Scoping 282  Timing 282  Manual Testing 284  Automated Testing 286  Fuzzing 287  Interactive Application Security Testing (IAST) 288  Bug Bounty Programs 289  Test Results 290  Actioning Test Results 291  Final Thoughts 293  Chapter Exercises 293  Chapter 13 Release/Deployment 295  Security Events Within the CI/CD 296  Breaking the Build 297  Secret Scanning 298  Static Analysis 298  Dynamic Analysis 298  Software Composition Analysis 299  Linting 299  Infrastructure as Code scanners 299  Securing the CI/CD Pipeline Itself 299  Assuring the Integrity of Your Release 302  Security Release Approval 303  Chapter Exercises 304  Chapter 14 Maintenance 305  Monitoring, Alerting, and Observability 306  Blocking/Shielding 308  Web Application Firewalls (WAFs) 309  Content Delivery Networks (CDNs) 309  Runtime Application Self-Protection (RASP) 310  Virtual Patching 310  API Gateways 310  A Special Note for Data Scientists 311  Continuous Testing 312  Security Incidents 313  Business Continuity and Disaster Recovery Planning 315  Chapter Exercises 317  Chapter 15 Conclusion 319  Good Habits 319  Your Responsibility 322  How Much Is Enough? 323  Using Artificial Intelligence Safely 325  Continuous Learning 327  Becoming a Champion 328  Getting Others on Board 330  Transitioning onto the Security Team 330  Applying for Security Jobs Outside of Your Organization 331  Conclusion 335  Summary of Part III 339  Checklist of Security Activities for Each Phase of the SDLC 339  Appendix A Resources 343  Chapter 1: Introductory Security Fundamentals 343  Chapter 2: Beginning 344  Chapter 3: Improving 345  Chapter 4: Achieving 347  Chapter 5: Technology-Specific 349  Chapter 6: Popular Programming Languages 351  Chapter 7: Popular Frameworks 355  Chapter 8: Vulnerability Categories 357  Chapter 10: Design 359  Chapter 11: Coding 359  Chapter 12: Testing 359  Chapter 13: Release/Deployment 360  Chapter 14: Maintenance 360  Appendix B Answer Keys 361  Chapter 1: Introductory Security Fundamentals 361  Chapter 2: Beginning 363  Chapter 3: Improving 364  Chapter 4: Achieving 365  Chapter 5: Technology-Specific 368  Chapter 8: Vulnerability Categories 370  Chapter 9: Requirements 371  Chapter 11: Coding 372  Chapter 12: Testing 373  Chapter 13: Release/Deployment 374  Chapter 14: Maintenance 375  Index 377


Best Sellers


Product Details
  • ISBN-13: 9781394171705
  • Publisher: John Wiley & Sons Inc
  • Publisher Imprint: John Wiley & Sons Inc
  • Height: 229 mm
  • No of Pages: 416
  • Spine Width: 15 mm
  • Width: 180 mm
  • ISBN-10: 1394171706
  • Publisher Date: 13 Feb 2025
  • Binding: Paperback
  • Language: English
  • Returnable: Y
  • Weight: 584 gr


Similar Products

How would you rate your experience shopping for books on Bookswagon?

Add Photo
Add Photo

Customer Reviews

REVIEWS           
Click Here To Be The First to Review this Product
Alice and Bob Learn Secure Coding
John Wiley & Sons Inc -
Alice and Bob Learn Secure Coding
Writing guidlines
We want to publish your review, so please:
  • keep your review on the product. Review's that defame author's character will be rejected.
  • Keep your review focused on the product.
  • Avoid writing about customer service. contact us instead if you have issue requiring immediate attention.
  • Refrain from mentioning competitors or the specific price you paid for the product.
  • Do not include any personally identifiable information, such as full names.

Alice and Bob Learn Secure Coding

Required fields are marked with *

Review Title*
Review
    Add Photo Add up to 6 photos
    Would you recommend this product to a friend?
    Tag this Book
    Read more
    Does your review contain spoilers?
    What type of reader best describes you?
    I agree to the terms & conditions
    You may receive emails regarding this submission. Any emails will include the ability to opt-out of future communications.

    CUSTOMER RATINGS AND REVIEWS AND QUESTIONS AND ANSWERS TERMS OF USE

    These Terms of Use govern your conduct associated with the Customer Ratings and Reviews and/or Questions and Answers service offered by Bookswagon (the "CRR Service").


    By submitting any content to Bookswagon, you guarantee that:
    • You are the sole author and owner of the intellectual property rights in the content;
    • All "moral rights" that you may have in such content have been voluntarily waived by you;
    • All content that you post is accurate;
    • You are at least 13 years old;
    • Use of the content you supply does not violate these Terms of Use and will not cause injury to any person or entity.
    You further agree that you may not submit any content:
    • That is known by you to be false, inaccurate or misleading;
    • That infringes any third party's copyright, patent, trademark, trade secret or other proprietary rights or rights of publicity or privacy;
    • That violates any law, statute, ordinance or regulation (including, but not limited to, those governing, consumer protection, unfair competition, anti-discrimination or false advertising);
    • That is, or may reasonably be considered to be, defamatory, libelous, hateful, racially or religiously biased or offensive, unlawfully threatening or unlawfully harassing to any individual, partnership or corporation;
    • For which you were compensated or granted any consideration by any unapproved third party;
    • That includes any information that references other websites, addresses, email addresses, contact information or phone numbers;
    • That contains any computer viruses, worms or other potentially damaging computer programs or files.
    You agree to indemnify and hold Bookswagon (and its officers, directors, agents, subsidiaries, joint ventures, employees and third-party service providers, including but not limited to Bazaarvoice, Inc.), harmless from all claims, demands, and damages (actual and consequential) of every kind and nature, known and unknown including reasonable attorneys' fees, arising out of a breach of your representations and warranties set forth above, or your violation of any law or the rights of a third party.


    For any content that you submit, you grant Bookswagon a perpetual, irrevocable, royalty-free, transferable right and license to use, copy, modify, delete in its entirety, adapt, publish, translate, create derivative works from and/or sell, transfer, and/or distribute such content and/or incorporate such content into any form, medium or technology throughout the world without compensation to you. Additionally,  Bookswagon may transfer or share any personal information that you submit with its third-party service providers, including but not limited to Bazaarvoice, Inc. in accordance with  Privacy Policy


    All content that you submit may be used at Bookswagon's sole discretion. Bookswagon reserves the right to change, condense, withhold publication, remove or delete any content on Bookswagon's website that Bookswagon deems, in its sole discretion, to violate the content guidelines or any other provision of these Terms of Use.  Bookswagon does not guarantee that you will have any recourse through Bookswagon to edit or delete any content you have submitted. Ratings and written comments are generally posted within two to four business days. However, Bookswagon reserves the right to remove or to refuse to post any submission to the extent authorized by law. You acknowledge that you, not Bookswagon, are responsible for the contents of your submission. None of the content that you submit shall be subject to any obligation of confidence on the part of Bookswagon, its agents, subsidiaries, affiliates, partners or third party service providers (including but not limited to Bazaarvoice, Inc.)and their respective directors, officers and employees.

    Accept

    New Arrivals


    Inspired by your browsing history


    Your review has been submitted!

    You've already reviewed this product!
    ASK VIDYA