-----Original Message-----
From: Yousef Syed [mailto:yousef.syed@gmail.com]
[...]
Can someone please advise me on what I should be looking for?
Where can I get further information on the procedure that
should be followed? Are there any Standards/Best Practices
for Securing J2EE applications?
Yousef, here's a list of resources I provide developers; it
includes links to other people's book lists as well. Many
items on here are Java-specific:
===============================================
Resources on Application and Software Security
===============================================
:::Web-Based Resources:::
OWASP (Open Web Application Security Project):
Focus: Whitepapers, Guidelines, Free Tools
http://www.owasp.org
WASC (Web Application Security Consortium)
Focus: Whitepapers, Research, Standards/Definitions
http://www.webappsec.org
http://www.webappsec.org/web_security_books.shtml (webappsec books)
Java Passion
Focus: J2EE, Security, Webappsec, OWASP Top-10
http://www.javapassion.com/j2ee/WebApplicationSecurity4.pdf
http://www.javapassion.com/j2ee/WebSecurityThreatsAndCounterMeasures4.pdf
http://www.javapassion.com/j2eeadvanced/index0.html#SyallbusforAdvanced
(on the last link search for "Advanced J2EE Security"; nice list of resources)
Threats and Countermeasures
Focus: Info on Patterns (attack/defense, and practice patterns) and Threat
Modeling
http://www.threatsandcountermeasures.com
Improving Web Application Security: Threats and Countermeasures
Focus: MS Centric, but good info, as book or updated web-based document:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/ThreatCounter.asp
TRIKE:
Focus: Threat Modeling
http://dymaxion.org/trike/index.shtml
Foundstone .NET toolkit
Focus: Free tools
www.foundstone.com/resources/proddesc/s3itoolkit.htm
:::Books on Application and Software Security:::
---------------Threat Modeling-----------------------
Threat Modeling, MS Press
http://www.microsoft.com/MSPress/books/6892.asp
----------Designing/Building Secure Apps---------
Secure Coding: Principles & Practices (High Level overview book):
http://www.securecoding.org/book/press.php
Security Engineering: A Guide to Designing Dependable,
-Distributed Applications, Ross Anderson
(Still one of the best security design and architecture books written)
http://www.cl.cam.ac.uk/~rja14/book.html
The Software Vulnerability Guide:
http://www.amazon.com/exec/obidos/tg/detail/-/1584503580/
----------------Writing Secure Code-----------------
19 Deadly Sins of Software Security
(Mostly a "Things Not to Do" book with examples/case studies)
http://www.amazon.com/exec/obidos/tg/detail/-/0072260858/
-Subset Unmanaged code
Secure Coding, 2nd Edition, MS Press (C/C++ oriented but
covers a wide variety of issues MS-centric)
http://www.microsoft.com/mspress/books/5957.asp
-Subset: Java
Building Secure Software, Hoglund and McGraw
(Secure Coding book, Java-centric)
http://www.amazon.com/exec/obidos/tg/detail/-/020172152X/
-Subset: .NET
---------------Attacking Software---------------------
-Subset: All
Exploiting Software: How to Break Code , Hoglund and McGraw
http://www.amazon.com/exec/obidos/tg/detail/-/0201786958/
How to Break Software, Whittaker
http://www.amazon.com/exec/obidos/tg/detail/-/0201796198
How to Break Software Security, by Whittaker, Thompson & Thompson
(This is more how to test/break software locally, think fat-client
software in a sandbox/vm way using fault injection, and resource
starvation; relies on their proprietary tool Holodeck)
http://www.amazon.com/exec/obidos/tg/detail/-/0321194330/
The Shellcoder's Handbook, Aitel and others (One of several on how to hack
software)
http://www.amazon.com/exec/obidos/tg/detail/-/0764544683/
Database Hacker's Handbook, David and Mark Litchfield, others
http://www.amazon.com/exec/obidos/tg/detail/-/0764578014/
The Shellcoder's Handbook, Aitel and others (One of several on how to hack
software)
http://www.amazon.com/exec/obidos/tg/detail/-/0764544683/
Database Hacker's Handbook, David and Mark Litchfield
http://www.amazon.com/exec/obidos/tg/detail/-/0764578014/
-Subset: Web
See WASC List above.
Arian J. Evans
FishNet Security
816.421.6611 [office]
816.701.2045 [direct] <--checked infrequently
888.732.9406 [toll-free]
816.421.6677 [fax]
913.710.7045 [mobile] <--daily/international access
aevans@fishnetsecurity.com [email]
http://www.fishnetsecurity.com
