Here are 100 books that Secure Coding in C and C++ fans have personally recommended if you like
Secure Coding in C and C++.
Shepherd is a community of 12,000+ authors and super readers sharing their favorite books with the world.
As a kid, I used to do all the math problems in my textbooks just for fun, even if they weren’t part of a homework assignment. My grandchildren cringe when I tell them this. I am a researcher and educator in secure software engineering and have enjoyed a productive career in software development and management, software engineering and software security research, and software and secure software engineering education.
Gary McGraw has been an advocate for the importance of developing secure software during the more than 15 years that I have known him, and before that! He has written a number of books, but this one captures his philosophy on how to develop secure software. It’s an excellent resource for practitioners and management.
"When it comes to software security, the devil is in the details. This book tackles the details." --Bruce Schneier, CTO and founder, Counterpane, and author of Beyond Fear and Secrets and Lies
"McGraw's book shows you how to make the 'culture of security' part of your development lifecycle." --Howard A. Schmidt, Former White House Cyber Security Advisor
"McGraw is leading the charge in software security. His advice is as straightforward as it is actionable. If your business relies on software (and whose doesn't), buy this book and post it up on the lunchroom wall." --Avi Rubin, Director of the NSF…
The Victorian mansion, Evenmere, is the mechanism that runs the universe.
The lamps must be lit, or the stars die. The clocks must be wound, or Time ceases. The Balance between Order and Chaos must be preserved, or Existence crumbles.
Appointed the Steward of Evenmere, Carter Anderson must learn the…
As a kid, I used to do all the math problems in my textbooks just for fun, even if they weren’t part of a homework assignment. My grandchildren cringe when I tell them this. I am a researcher and educator in secure software engineering and have enjoyed a productive career in software development and management, software engineering and software security research, and software and secure software engineering education.
This book is a “how-to” guide for teams developing secure software. Written by a team of experts, it covers the important issues in developing software that is better able to prevent successful attacks. The book contains many references, a strategy, and an implementation guide with cross-references. For each topic, the maturity of practice at the time of writing is provided, as well as an indication of the audience.
"This book's broad overview can help an organization choose a set of processes, policies, and techniques that are appropriate for its security maturity, risk tolerance, and development style. This book will help you understand how to incorporate practical security techniques into all phases of the development lifecycle."
-Steve Riley, senior security strategist, Microsoft Corporation
"There are books written on some of the topics addressed in this book, and there are other books on secure systems engineering. Few address the entire life cycle with a comprehensive overview and discussion of emerging trends and topics as well as this one."
As a kid, I used to do all the math problems in my textbooks just for fun, even if they weren’t part of a homework assignment. My grandchildren cringe when I tell them this. I am a researcher and educator in secure software engineering and have enjoyed a productive career in software development and management, software engineering and software security research, and software and secure software engineering education.
This is one of the first books resulting from the Microsoft security “push,” and it’s a classic. It’s of interest both in understanding how Microsoft went about tackling the problem of developing secure software, and as a backdrop for the evolution of secure software development practices that emerged at Microsoft and other major software vendors.
Your customers demand and deserve better security and privacy in their software. This book is the first to detail a rigorous, proven methodology that measurably minimizes security bugs-the Security Development Lifecycle (SDL). In this long-awaited book, security experts Michael Howard and Steve Lipner from the Microsoft Security Engineering Team guide you through each stage of the SDL-from education and design to testing and post-release. You get their first-hand insights, best practices, a practical history of the SDL, and lessons to help you implement the SDL in any development organization.
Discover how to:
Use a streamlined risk-analysis process to find security…
The Guardian of the Palace is the first novel in a modern fantasy series set in a New York City where magic is real—but hidden, suppressed, and dangerous when exposed.
When an ancient magic begins to leak into the world, a small group of unlikely allies is forced to act…
As a kid, I used to do all the math problems in my textbooks just for fun, even if they weren’t part of a homework assignment. My grandchildren cringe when I tell them this. I am a researcher and educator in secure software engineering and have enjoyed a productive career in software development and management, software engineering and software security research, and software and secure software engineering education.
Although strictly speaking, this book is not on software security, it is so well-known in the field as a general reference that it deserves to be on this list. It discusses the important issues of computer security and can be used as either a textbook or a reference. No doubt that many, if not most, students of computer security are familiar with this book.
Today, everyone recognizes the importance of safeguarding computer systems and networks from vulnerability, attack, and compromise. But computer security is neither an easy art nor a simple science: its methodologies and technologies require rigorous study, and a deep grounding in principles that can be applied even as technologies change. Moreover, practitioners must understand how to align concepts with real policies, and then actually implement those policies -- managing inevitable tradeoffs such as "How secure do our devices really need to be, and how much inconvenience can we accept?"
In his extensively updated Computer Security: Art and Science, 2nd Edition, University…
I’ve been playing with computers and electronics since childhood. I even supported the people in my village with their computer issues back then. During my studies in electrical engineering, I learned how to solve technical challenges with structured approaches. At this time, I became fascinated by topics like cryptography and embedded system security. The books on this list helped me understand important concepts and practical real-world obstacles. I hope they are also of value to you!
When I take this book off my shelf, the probability that I find the answer I'm looking for is very high. Yes, it's a big book, and I'm pretty sure I haven't read every single page yet, but because of its broad coverage of security engineering knowledge, from crypto to real-world processes, it is an invaluable reference for teaching and practical cyber security.
Now that there's software in everything, how can you make anything secure? Understand how to engineer dependable systems with this newly updated classic
In Security Engineering: A Guide to Building Dependable Distributed Systems, Third Edition Cambridge University professor Ross Anderson updates his classic textbook and teaches readers how to design, implement, and test systems to withstand both error and attack.
This book became a best-seller in 2001 and helped establish the discipline of security engineering. By the second edition in 2008, underground dark markets had let the bad guys specialize and scale up; attacks were increasingly on users rather than…
Being able to understand and change reality through our knowledge and skill is literal magic. We’re building systems with so many exciting and unexpected properties that can be exploited and repurposed for both good and evil. I want to keep some of that magic and help people engineer – build great systems that make people’s lives better. I’ve been securing (and breaking) systems, from operating rooms to spaceships, from banks to self-driving cars for over 25 years. The biggest lesson I’ve learned is that if security is not infused from the start, we’re forced to rely on what ought to be our last lines of defense. This list helps you infuse security into your systems.
Loren’s been contributing to security for over 40 years, and this book captures his hard-won wisdom in a way that’s both humble and accessible. It scales from principles and design approaches to in-depth explanations of exactly how things go wrong and how to avoid those problems. (Also, I was honored to write the foreword.)
Designing Secure Software consolidates Loren Kohnfelder's more than twenty years of experience into a concise, elegant guide to improving the security of technology products. Written for a wide range of software professionals, it emphasizes building security into software design early and involving the entire team in the process. The book begins with a discussion of core concepts. The second part, perhaps this book's most important contribution, covers the process of designing and reviewing a software design with security considerations in mind. The final section details the most common coding flaws that create vulnerabilities, making copious use of code snippets written…
Aury and Scott travel to the Finger Lakes in New York’s wine country to get to the bottom of the mysterious happenings at the Songscape Winery. Disturbed furniture and curious noises are one thing, but when a customer winds up dead, it’s time to dig into the details and see…
I’m just a book-loving girl working in a corporate world who’s sick to death of the inaccurate representations of technology in fiction. FYI, tracing a phone call is instantaneous, no need to keep that pesky murderer on the line these days. Technology is so ingrained in our daily lives and most people have very limited knowledge of what it actually does, so I became fascinated with the idea of using real modern-day tech in murder mysteries. I got so obsessed with the idea I decided to write it. No Sci-Fi of future tech, it may seem farfetched, but all the electronic wizardry used in my novels is real and accurately represented.
Ah, Dan Brown. Love him or hate him, he’s a paragon of the modern thriller. Let’s go way back to 1998. It was pre-DaVinci Code, and he released his first novel, Digital Fortress. For the time period, it was a unique idea. A woman cryptologist at the NSA gets embroiled in a high-stakes murder mystery and the only way through is to solve the code. There are a lot of issues with this book, primarily that the author couldn’t be bothered to check his work and misuses bits and bytes throughout the whole novel which makes the code-breaking premise ridiculous. But to be fair, this was 1998 and for a first novel, it’s still a fun ride. So, if you’re a Dan Brown fan or love a fast-paced easy read give it a try. If you have even a basic understanding of how encryption works you may…
A former National Security Agency programmer threatens to release a mathematical formula that will allow organized crime and terrorism to skyrocket, unless the code-breaking computer that is used to keep them in check but that violates civil rights is not exposed to the public.
I became enthused about using mathematical models to understand the natural world as an undergraduate, got trained to do so, and spent my career working on a wide variety of applications. Most recently, I translated ideas from disease modeling to understand cyber variability and security.
To maximize success when applying mathematics to the natural or (for cyber) operational world, one needs to master the appropriate mathematical tools and have a deep knowledge of the subject matter. My recommendations are three really great books that will help you gain proficiency in the needed mathematical tools and how to apply them, and two equally great books on cyber systems.
This is a classic! I have had (and worn through copies) since 1969.
There is no explicit mention of disease in Maynard Smith’s book, but the two chapters on population regulation will give you all the tools you need to start applying ideas from disease biology.
As with the Feynman lectures, there is mathematics in this book – but it begins with arithmetic. I recommend it for much the same reason that I recommend Feynman because it will show you how mathematical reasoning can illuminate biology and was written by one the great mathematical biologists of the 20th century.
The book is written for biologists and has the same quality as Feynman’s lectures of having plenty of words that bring the mathematics to life.
This is a lucid introduction to some of the mathematical ideas which are useful to biologists. Professor Maynard Smith introduces the reader to the ways in which biological problems can be expressed mathematically, and shows how the mathematical equations which arise in biological work can be solved. Each chapter has a number of examples which present further points of biological and mathematical interest. interest. Professor Maynard Smith's book is written for all biologists, from undergraduate level upwards, who need mathematical tools. Only an elementary knowledge of mathematics is assumed. Since there are already a number of books dealing with statistics…
I started learning cryptography in the early 2000s with books borrowed from my university’s library, and with information I could find online. Since then I’ve practiced cryptography for 15 years in a variety of contexts: as an academic researcher, while working on my PhD; as a cryptography engineer for software and hardware pay-TV systems; as a consultant for private and public sector clients; as a vulnerability researcher in my spare time; as a code auditor for cryptography projects; as a start-up founder in the domain of IoT security; and as CSO (chief security officer) of a fintech start-up. I live in Lausanne, Switzerland, and besides crypto I enjoy literature, rock climbing, and playing classical guitar.
Although David is a friend, I only recommend his book because it’s great, both in terms of content and presentation. Real-World Cryptography is today’s reference book about cryptographic tools and applications: Modern schemes such as the SHA-3 hash function and the Noise protocol framework, end-to-end encryption protocols, cryptocurrencies’ cryptography mechanisms, as well as emerging techniques like fully-homomorphic encryption and multi-party computation; Wong’s book delivers a practice-oriented, accessible introduction, enriched by many visual illustrations (including original comics strips!), and exercises (with their solutions).
If you're browsing the web, using public APIs, making and receiving electronic payments, registering and logging in users, or experimenting with blockchain, you're relying on cryptography. And you're probably trusting a collection of tools, frameworks, and protocols to keep your data, users, and business safe. It's important to understand these tools so you can make the best decisions about how, where, and why to use them. Real-World Cryptography teaches you applied cryptographic techniques to understand and apply security at every level of your systems and applications. about the technologyCryptography is the foundation of information security. This simultaneously ancient and emerging…
Magical realism meets the magic of Christmas in this mix of Jewish, New Testament, and Santa stories–all reenacted in an urban psychiatric hospital!
On locked ward 5C4, Josh, a patient with many similarities to Jesus, is hospitalized concurrently with Nick, a patient with many similarities to Santa. The two argue…
Being able to understand and change reality through our knowledge and skill is literal magic. We’re building systems with so many exciting and unexpected properties that can be exploited and repurposed for both good and evil. I want to keep some of that magic and help people engineer – build great systems that make people’s lives better. I’ve been securing (and breaking) systems, from operating rooms to spaceships, from banks to self-driving cars for over 25 years. The biggest lesson I’ve learned is that if security is not infused from the start, we’re forced to rely on what ought to be our last lines of defense. This list helps you infuse security into your systems.
This book captures lessons from many authors at Google, some of whom I’ve worked with over the years. The chapters on availability (7, 8, 9) were a revelation to me. I had no idea how Google approaches the topic of resilience and recovery in their systems, and I now think of the whole topic very differently. The biggest takeaway is how to think about the design of systems.
Can a system be considered truly reliable if it isn't fundamentally secure? Or can it be considered secure if it's unreliable? Security is crucial to the design and operation of scalable systems in production, as it plays an important part in product quality, performance, and availability. In this book, experts from Google share best practices to help your organization design scalable and reliable systems that are fundamentally secure.
Two previous O'Reilly books from Google-Site Reliability Engineering and The Site Reliability Workbook-demonstrated how and why a commitment to the entire service lifecycle enables organizations to successfully build, deploy, monitor, and maintain…
