?In the Java world, security is not viewed as an add-on a feature. It is a pervasive way of thinking. Those who forget to think in a secure mindset end up in trouble. But just because the facilities are there doesn?t mean that security is assured automatically. A set of standard practices has evolved over the years. The Secure� Coding� Standard for JavaTM is a compendium of these practices. These are not theoretical research papers or product marketing blurbs. This is all serious, mission-critical, battle-tested, enterprise-scale stuff.? ?James A. Gosling, Father of the Java Programming Language An essential element of secure coding in the Java programming language is a well-documented and enforceable coding standard. Coding standards encourage programmers to follow a uniform set of rules determined by the requirements of the project and organization, rather than by the programmer?s familiarity or preference. Once established, these standards can be used as a metric to evaluate source code (using manual or automated processes). The CERT� Oracle� Secure Coding Standard for JavaTM provides rules designed to eliminate insecure coding practices that can lead to exploitable vulnerabilities. Application of the standard?s guidelines will lead to higher-quality systems?robust systems that are more resistant to attack. Such guidelines are required for the wide range of products coded in Java?for devices such as PCs, game players, mobile phones, home appliances, and automotive electronics. After a high-level introduction to Java application security, seventeen consistently organized chapters detail specific rules for key areas of Java development. For each area, the authors present noncompliant examples and corresponding compliant solutions, show how to assess risk, and offer references for further information. Each rule is prioritized based on the severity of consequences, likelihood of introducing exploitable vulnerabilities, and cost of remediation. The standard provides secure coding rules for the Java SE 6 Platform including the Java programming language and libraries, and also addresses new features of the Java SE 7 Platform. It describes language behaviors left to the discretion of JVM and compiler implementers, guides developers in the proper use of Java?s APIs and security architecture, and considers security concerns pertaining to standard extension APIs (from the javax package hierarchy).The standard covers security issues applicable to these libraries: lang, util, Collections, Concurrency Utilities, Logging, Management, Reflection, Regular Expressions, Zip, I/O, JMX, JNI, Math, Serialization, and JAXP.

Bestandsnummer des Verk�ufers CIN0321803957G

Verk�ufer kontaktieren

Diesen Artikel melden

Bibliografische Details

Titel: CERT Oracle Secure Coding Standard for Java, The
Verlag: Pearson Education (US)
Erscheinungsjahr: 2011
Sprache: Englisch
ISBN-10: 0321803957
ISBN-13: 9780321803955
Einband: Paperback
Zustand: Good

�ber diesen Titel

Inhaltsangabe

This is the first authoritative, comprehensive compilation of code-level requirements for building secure systems in Java. Organized by CERT's pioneering software security experts, with support from Oracle's own Java platform developers, it covers every facet of secure software coding with Java 7 SE and Java 6 SE, and offers value even to developers working with other Java versions. The authors itemize the most common coding errors leading to vulnerabilities in Java programs, and provide specific guidelines for avoiding each of them. They show how to produce programs that are not only secure, but also safer, more reliable, more robust, and easier to maintain. After a high-level introduction to Java application security, eighteen consistently-organized chapters detail specific guidelines for each facet of Java development. Each set of guidelines defines conformance, presents both non-compliant examples and corresponding compliant solutions, shows how to assess risk, and offers references for further information. To limit this book's size, the authors focus on "normative requirements": strict rules for what programmers must do for their work to be secure, as defined by conformance to specific standards that can be tested through automated analysis software. (Note: A follow-up book will present "non-normative requirements": recommendations for what Java developers typically "should" do to further strengthen program security beyond testable "requirements.")

�ber die Autorin bzw. den Autor

Ve>Fred Long is a senior lecturer and director of learning and teaching in the Department of Computer Science, Aberystwyth University in the United Kingdom. He lectures on formal methods; Java, C++, and C programming paradigms and programming-related security issues. He is chairman of the British Computer Society’s Mid-Wales Sub-Branch. Fred has been a Visiting Scientist at the Software Engineering Institute since 1992. Recently, his research has involved the investigation of vulnerabilities in Java.

Dhruv Mohindra is a senior software engineer at Persistent Systems Limited, India, where he develops monitoring software for widely used enterprise servers. He has worked for CERT at the Software Engineering Institute and continues to collaborate to improve the state of security awareness in the programming community.

Dhruv has also worked for Carnegie Mellon University, where he obtained his master of science degree in information security policy and management. He holds an undergraduate degree in computer engineering from Pune University, India, where he researched with Calsoft, Inc., during his academic pursuit.

A writing enthusiast, Dhruv occasionally contributes articles to technology magazines and online resources. He brings forth his experience and learning from developing and securing service oriented applications, server monitoring software, mobile device applications, web-based data miners, and designing user-friendly security interfaces.

Robert C. Seacord is a computer security specialist and writer. He is the author of books on computer security, legacy system modernization, and component-based software engineering.

Robert manages the Secure Coding Initiative at CERT, located in Carnegie Mellon’s Software Engineering Institute in Pittsburgh, Pennsylvania. CERT, among other security-related activities, regularly analyzes software vulnerability reports and assesses the risk to the Internet and other critical infrastructure. Robert is an adjunct professor in the Carnegie Mellon University School of Computer Science and in the Information Networking Institute.

Robert started programming professionally for IBM in 1982, working in communications and operating system software, processor development, and software engineering. Robert also has worked at the X Consortium, where he developed and maintained code for the Common Desktop Environment and the X Window System. Robert has a bachelor’s degree in computer science from Rensselaer Polytechnic Institute.

Dean F. Sutherland is a senior software security engineer at CERT. Dean received his Ph.D. in software engineering from Carnegie Mellon in 2008. Before his return to academia, he spent 14 years working as a professional software engineer at Tartan, Inc. He spent the last six of those years as a senior member of the technical staff and a technical lead for compiler backend technology. He was the primary active member of the corporate R&D group, was a key instigator of the design and deployment of a new software development process for Tartan, led R&D projects, and provided both technical and project leadership for the 12-person compiler back-end group.

David Svoboda is a software security engineer at CERT. David has been the primary developer on a diverse set of software development projects at Carnegie Mellon since 1991, ranging from hierarchical chip modeling and social organization simulation to automated machine translation (AMT). His KANTOO AMT software, developed in 1996, is still in production use at Caterpillar. He has over 13 years of Java development experience, starting with Java 2, and his Java projects include Tomcat servlets and Eclipse plug-ins. David is also actively involved in several ISO standards groups: the JTC1/SC22/WG14 group for the C programming language and the JTC1/ SC22/WG21 group for C++.

��ber diesen Titel� kann sich auf eine andere Ausgabe dieses Titels beziehen.

Anbieterinformationen

Founded in 2002, World of Books is a leading online destination for buying and selling both preloved and new books, committed to making sustainable reading accessible to all. With a mission to help people read more and waste less, World of Books offers a huge range of affordable, high-quality books ? giving both new and preloved titles a second life. The company also operates World of Books ? Sell Your Books, an easy-to-use platform that allows customers to trade in unwanted books for cash, helping to keep books in circulation while promoting sustainability. As a Certified B Corp, World of Books is driven by a vision to become the world?s largest and most sustainable dedicated online bookstore. The company measures its success through the positive environmental impact it creates, the value it provides to customers, and its ability to operate profitably while supporting its sustainable mission

Zur Homepage des Verk�ufers

Unternehmensdaten des Verk�ufers

SBYB, Inc.
900 Knell Road, Montgomery, IL, 60538, U.S.A.

Gesch�ftsbedingungen und Versandinformationen

Verkaufsbedingungen

Widerrufsrecht

Wenn Sie Verbraucher sind, k�nnen Sie gem�� den folgenden Bestimmungen vom Vertrag zur�cktreten. Verbraucher ist jede nat�rliche Person, die zu Zwecken handelt, die nicht ihrer kaufm�nnischen, gewerblichen, k�nstlerischen oder beruflichen T�tigkeit zugerechnet werden k�nnen.

Informationen zum Widerrufsrecht

Gesetzliches Widerrufsrecht

Sie haben das Recht, den Vertrag innerhalb von 14 Tagen ohne Angabe von Gr�nden zu widerrufen.

Die Widerrufsfrist betr�gt 14 Tage ab dem Tag, an dem Sie oder ein von Ihnen benannter Dritter, der nicht der Transporteur ist, die letzte Ware oder den letzten Posten oder das letzte Exemplar in Besitz genommen hat.

Um das Widerrufsrecht auszu�ben, f�llen Sie auf unserer Website unter „Meine Eink�ufe" in „Mein Nutzerkonto" eine eindeutige Erkl�rung elektronisch aus und senden Sie sie ab. Wir werden Ihnen unverz�glich eine Best�tigung �ber den Eingang eines solchen Widerrufs auf einem dauerhaften Datentr�ger (z. B. per E-Mail) �bermitteln.

Um die Widerrufsfrist einzuhalten, reicht es aus, dass Sie Ihre Mitteilung �ber die Aus�bung des Widerrufsrechts vor Ablauf der Widerrufsfrist absenden.

Auswirkungen des Widerrufs

Wenn Sie diesen Vertrag widerrufen, erstatten wir Ihnen alle Zahlungen, die wir von Ihnen erhalten haben, einschlie�lich der Lieferkosten (mit Ausnahme der zus�tzlichen Kosten, die entstehen, wenn Sie eine andere Art der Lieferung als die von uns angebotene g�nstigste Standardlieferung gew�hlt haben).

Wir k�nnen einen Abzug von der R�ckerstattung f�r den Wertverlust der gelieferten Waren vornehmen, wenn der Verlust auf eine unn�tige Behandlung durch Sie zur�ckzuf�hren ist.

Wir werden die R�ckerstattung unverz�glich und nicht sp�ter als 14 Tage nach dem Tag vornehmen, an dem wir �ber Ihre Entscheidung, diesen Vertrag zu widerrufen, informiert wurden.

F�r die R�ckerstattung verwenden wir dasselbe Zahlungsmittel, das Sie f�r die urspr�ngliche Transaktion verwendet haben, es sei denn, Sie haben ausdr�cklich etwas anderes vereinbart; in keinem Fall werden Ihnen aufgrund einer solchen R�ckerstattung Geb�hren berechnet.

Wir k�nnen die R�ckzahlung verweigern, bis wir die Waren wieder zur�ckerhalten haben oder Sie den Nachweis erbracht haben, dass Sie die Waren zur�ckgesandt haben, je nachdem, was eher eintritt.

Sie m�ssen die Waren unverz�glich und in jedem Fall sp�testens 14 Tage ab dem Tag, an dem Sie uns �ber den Widerruf dieses Vertrags unterrichten, an World of Books Inc, Montgomery, Illinois, U.S.A., zur�cksenden oder �bergeben. Die Frist ist eingehalten, wenn Sie die Ware vor Ablauf der Frist von 14 Tagen zur�cksenden. Sie m�ssen die direkten Kosten der R�cksendung der Waren tragen. Sie haften nur f�r einen etwaigen Wertverlust der Waren, der auf eine Behandlung zur�ckzuf�hren ist, die nicht zur Pr�fung der Art, Eigenschaften und Funktionsweise der Waren erforderlich ist.

Ausnahmen vom Widerrufsrecht

Das Widerrufsrecht gilt nicht f�r:

Die Lieferung von Zeitungen, Zeitschriften oder Magazinen mit Ausnahme von Abonnementvertr�gen; und
Die Lieferung digitaler Inhalte, die nicht auf einem physischen Medium (z. B. auf einer CD oder DVD) geliefert werden, wenn Sie bei Ihrer Bestellung akzeptiert haben, dass wir mit der Lieferung beginnen k�nnen und dass Sie nach Beginn der Lieferung den Vertrag nicht mehr widerrufen k�nnen.

Versandbedingungen

Versandkosten innerhalb von USA

Versandkosten innerhalb von USA
Bestellmenge	4 bis 12�Werktage	3 bis 6�Werktage
Erster Artikel	EUR 0.00	EUR 9.67

Die Versandzeiten werden von den Verk�uferinnen und Verk�ufern festgelegt. Sie variieren je nach Versanddienstleister und Standort. Sendungen, die den Zoll passieren, k�nnen Verz�gerungen unterliegen. Eventuell anfallende Abgaben oder Geb�hren sind von der K�uferin bzw. dem K�ufer zu tragen. Die Verk�uferin bzw. der Verk�ufer kann Sie bez�glich zus�tzlicher Versandkosten kontaktieren, um einen m�glichen Anstieg der Versandkosten f�r Ihre Artikel auszugleichen.

Zahlungsarten

Zu Kaufgesuchen hinzuf�gen