Learn application security from the very start, with this comprehensive and approachable guide!
Alice and Bob Learn Application Security is an accessible and thorough resource for anyone seeking to incorporate, from the beginning of the System Development Life Cycle, best security practices in software development. This book covers all the basic subjects such as threat modeling and security testing, but also dives deep into more complex and advanced topics for securing modern software systems and architectures. Throughout, the book offers analogies, stories of the characters Alice and Bob, real-life examples, technical explanations and diagrams to ensure maximum clarity of the many abstract and complicated subjects.
Topics include:
- Secure requirements, design, coding, and deployment
- Security Testing (all forms)
- Common Pitfalls
- Application Security Programs
- Securing Modern Applications
- Software Developer Security Hygiene
Alice and Bob Learn Application Security is perfect for aspiring application security engineers and practicing software developers, as well as software project managers, penetration testers, and chief information security officers who seek to build or improve their application security programs.
Alice and Bob Learn Application Security illustrates all the included concepts with easy-to-understand examples and concrete practical applications, furthering the reader's ability to grasp and retain the foundational and advanced topics contained within.
Table of Contents
Foreword xxi
Introduction xxiii
Part I What You Must Know to Write Code Safe Enough to Put on the Internet 1
Chapter 1 Security Fundamentals 3
The Security Mandate: CIA 3
Confidentiality 4
Integrity 5
Availability 5
Assume Breach 7
Insider Threats 8
Defense in Depth 9
Least Privilege 11
Supply Chain Security 11
Security by Obscurity 13
Attack Surface Reduction 14
Hard Coding 15
Never Trust, Always Verify 15
Usable Security 17
Factors of Authentication 18
Exercises 20
Chapter 2 Security Requirements 21
Requirements 22
Encryption 23
Never Trust System Input 24
Encoding and Escaping 28
Third-Party Components 29
Security Headers: Seatbelts for Web Apps 31
Security Headers in Action 32
X-XSS-Protection 32
Content-Security-Policy (CSP) 32
X-Frame-Options 35
X-Content-Type-Options 36
Referrer-Policy 36
Strict-Transport-Security (HSTS) 37
Feature-Policy 38
X-Permitted-Cross-Domain-Policies 39
Expect-CT 39
Public Key Pinning Extension for HTTP (HPKP) 41
Securing Your Cookies 42
The Secure Flag 42
The HttpOnly Flag 42
Persistence 43
Domain 43
Path 44
Same-Site 44
Cookie Prefixes 45
Data Privacy 45
Data Classification 45
Passwords, Storage, and Other Important Decisions 46
HTTPS Everywhere 52
TLS Settings 53
Comments 54
Backup and Rollback 54
Framework Security Features 54
Technical Debt = Security Debt 55
File Uploads 56
Errors and Logging 57
Input Validation and Sanitization 58
Authorization and Authentication 59
Parameterized Queries 59
URL Parameters 60
Least Privilege 60
Requirements Checklist 61
Exercises 63
Chapter 3 Secure Design 65
Design Flaw vs. Security Bug 66
Discovering a Flaw Late 67
Pushing Left 68
Secure Design Concepts 68
Protecting Sensitive Data 68
Never Trust, Always Verify/Zero Trust/Assume Breach 70
Backup and Rollback 71
Server-Side Security Validation 73
Framework Security Features 74
Security Function Isolation 74
Application Partitioning 75
Secret Management 76
Re-authentication for Transactions (Avoiding CSRF) 76
Segregation of Production Data 77
Protection of Source Code 77
Threat Modeling 78
Exercises 82
Chapter 4 Secure Code 83
Selecting Your Framework and Programming Language 83
Example #1 85
Example #2 85
Example #3 86
Programming Languages and Frameworks: The Rule 87
Untrusted Data 87
HTTP Verbs 89
Identity 90
Session Management 91
Bounds Checking 93
Authentication (AuthN) 94
Authorization (AuthZ) 96
Error Handling, Logging, and Monitoring 99
Rules for Errors 100
Logging 100
Monitoring 101
Exercises 103
Chapter 5 Common Pitfalls 105
OWASP 105
Defenses and Vulnerabilities Not Previously Covered 109
Cross-Site Request Forgery 110
Server-Side Request Forgery 112
Deserialization 114
Race Conditions 115
Closing Comments 117
Exercises 117
Part II What You Should Do to Create Very Good Code 119
Chapter 6 Testing and Deployment 121
Testing Your Code 121
Code Review 122
Static Application Security Testing (SAST) 123
Software Composition Analysis (SCA) 125
Unit Tests 126
Infrastructure as Code (IaC) and Security as Code (SaC) 128
Testing Your Application 129
Manual Testing 130
Browsers 131
Developer Tools 131
Web Proxies 132
Fuzzing 133
Dynamic Application Security Testing (DAST) 133
VA/Security Assessment/PenTest 135
Testing Your Infrastructure 141
Testing Your Database 141
Testing Your APIs and Web Services 142
Testing Your Integrations 143
Testing Your Network 144
Deployment 145
Editing Code Live on a Server 146
Publishing from an IDE 146
“Homemade” Deployment Systems 147
Run Books 148
Contiguous Integration/Continuous Delivery/Continuous Deployment 148
Exercises 149
Chapter 7 An AppSec Program 151
Application Security Program Goals 152
Creating and Maintaining an Application Inventory 153
Capability to Find Vulnerabilities in Written, Running, and Third-Party Code 153
Knowledge and Resources to Fix the Vulnerabilities 154
Education and Reference Materials 155
Providing Developers with Security Tools 155
Having One or More Security Activities During Each Phase of Your SDLC 156
Implementing Useful and Effective Tooling 157
An Incident Response Team That Knows When to Call You 157
Continuously Improve Your Program Based on Metrics, Experimentation, and Feedback 159
Metrics 159
Experimentation 161
Feedback from Any and All Stakeholders 161
A Special Note on DevOps and Agile 162
Application Security Activities 162
Application Security Tools 164
Your Application Security Program 165
Exercises 166
Chapter 8 Securing Modern Applications and Systems 167
APIs and Microservices 168
Online Storage 171
Containers and Orchestration 172
Serverless 174
Infrastructure as Code (IaC) 175
Security as Code (SaC) 177
Platform as a Service (PaaS) 178
Infrastructure as a Service (IaaS) 179
Continuous Integration/Delivery/Deployment 180
Dev(Sec)Ops 180
DevSecOps 182
The Cloud 183
Cloud Computing 183
Cloud Native 184
Cloud Native Security 185
Cloud Workflows 185
Modern Tooling 186
IAST Interactive Application Security Testing 186
Runtime Application Security Protection 187
File Integrity Monitoring 187
Application Control Tools (Approved Software Lists) 187
Security Tools Created for DevOps Pipelines 188
Application Inventory Tools 188
Least Privilege and Other Policy Automation 189
Modern Tactics 189
Summary 191
Exercises 191
Part III Helpful Information on How to Continue to Create Very Good Code 193
Chapter 9 Good Habits 195
Password Management 196
Remove Password Complexity Rules 196
Use a Password Manager 197
Passphrases 198
Don’t Reuse Passwords 198
Do Not Implement Password Rotation 199
Multi-Factor Authentication 199
Incident Response 200
Fire Drills 201
Continuous Scanning 202
Technical Debt 202
Inventory 203
Other Good Habits 204
Policies 204
Downloads and Devices 204
Lock Your Machine 204
Privacy 205
Summary 206
Exercises 206
Chapter 10 Continuous Learning 207
What to Learn 208
Offensive = Defensive 208
Don’t Forget Soft Skills 208
Leadership != Management 209
Learning Options 209
Accountability 212
Create Your Plan 213
Take Action 214
Exercises 214
Learning Plan 216
Chapter 11 Closing Thoughts 217
Lingering Questions 218
When Have You Done Enough? 218
How Do You Get Management on Board? 220
How Do You Get Developers on Board? 221
Where Do You Start? 222
Where Do You Get Help? 223
Conclusion 223
Appendix A Resources 225
Introduction 225
Chapter 1: Security Fundamentals 225
Chapter 2: Security Requirements 226
Chapter 3: Secure Design 227
Chapter 4: Secure Code 228
Chapter 5: Common Pitfalls 228
Chapter 6: Testing and Deployment 229
Chapter 7: An AppSec Program 229
Chapter 8: Securing Modern Applications and Systems 230
Chapter 9: Good Habits 231
Chapter 10: Continuous Learning 231
Appendix B Answer Key 233
Chapter 1: Security Fundamentals 233
Chapter 2: Security Requirements 235
Chapter 3: Secure Design 236
Chapter 4: Secure Code 238
Chapter 5: Common Pitfalls 241
Chapter 6: Testing and Deployment 242
Chapter 7: An AppSec Program 244
Chapter 8: Securing Modern Applications and Systems 245
Chapter 9: Good Habits 247
Chapter 10: Continuous Learning 248
Index 249
