Foundations of Security: What Every Programmer Needs to Know

An excellent book for new programmers. The first part of the book provides a very good overview of security concepts. Chapters 5-10 detail different attacks and their defense. At 290 pages, the authors don’t waste the reader’s time. Information is well covered with enough detail for most readers.

Throughout the book the authors present code examples on exploits and their defense. Even through the examples are written in different languages, the authors explain the code clearly. The reader doesn’t’ have to be familiar with the particular language. I haven’t written anything in Java in over six years, but had no problem understand the Java examples.

If you are a new programmer or haven’t read a book on security recently, this would be the book.

Rating: 5 / 5

Our collective security against threats such as phishing, denial of service and online fraud in general depends not only on our own actions, but also on those of others. While other users may affect your security by their actions (or lack thereof), the most important person in terms of your security is the software developer. This is a book written to help software developers identify common problems and create security-conscious designs.

This easily accessible book describes common problems in an instructive manner. It explains what will and what will not work, reviews good design principles, and offers an overview of commonly used cryptographic techniques. If every developer lived by the guidelines of this book, we would be in a much better shape than we currently are.
Rating: 5 / 5

This book is very well written and easy to understand. I like the selection of software security topics it covers – blending of design principles and methodology with a mix of programming techniques.

Upon completion of the book, the reader should have a good basic computer security foundation.

Rating: 4 / 5

While some of the good security books for software developers need to be updated, this is, in my opinion, a much needed new security book for programmers. It is clear yet not too formal with good examples. Even if you have done a bit of security programming, chapters 7 and on are definitely worth the read.

Although this book doesn’t have all the answers (e.g. no comparison of web programming languages), web programmers will not be disappointed and my guess is that most web programmers need to read this book.

The authors work at Google and are dealing with some of the nastiest problems the Internet has to offer. They are very good communicators, have written some of the best recent papers and I’m glad to see Neil Daswani just started a blog on blogspot.
Rating: 5 / 5

This book teaches new and current software professionals state-of-the-art software security design principles, methodology, and concrete programming techniques they need to build secure software systems.

Rating: 5 / 5