The CSSLP Prep Guide: Mastering the Certified Secure Software Lifecycle Professional Review

Average Reviews:

(More customer reviews)THe CSSLP Prep Guide is an excellent source for understanding the fundamentals and basics of Secure Software Development, however after sitting for the CSSLP exam the book misses the mark and is not very well suited for preparing to take the exam.
The exam is filled with subjectivity as you really have to understand the mindset of the person writing the question as the answers are what is BEST or PRIMARY or MOST IMPORTANT OR MUST BE DONE and the book can't really prepare you for that.
It will still be used as an excellent piece of reference material for buidling the overall security program within my organization but if I didn't pass the exam I will wait for the ISC(2) book or take a boot camp class to prepare for the re-take.

Click Here to see more reviews about: The CSSLP Prep Guide: Mastering the Certified Secure Software Lifecycle Professional


The first test prep guide for the new ISC2 Certified Secure Software Lifecycle Professional exam

The CSSLP (Certified Secure Software Lifecycle Professional) is a new certification that incorporates government standards and best practices for secure software development. It emphasizes the application of secure software methodologies during the software development cycle. If you're an IT professional, security professional, software developer, project manager, software assurance tester, executive manager or employee of a government agency in a related field, your career may benefit from this certification.
Written by experts in computer systems and security, The CSSLP Prep Guide thoroughly covers all aspects of the CSSLP certification exam, with hundreds of sample test questions and answers available on the accompanying CD.
The Certified Secure Software Lifecycle Professional (CSSLP) is an international certification incorporating new government, commercial, and university derived secure software development methods; it is a natural complement to the CISSP credential
The study guide covers the seven domains of the CSSLP Common Body of Knowledge (CBK), namely Secure Software Concepts, Secure Software Requirements, Secure Software Design, and Secure Software Implementation/Coding and Testing,Secure Software Testing, Software Acceptance, and Software Deployment, Operations, Maintenance and Disposal
Provides in-depth exploration and explanation of the seven CSSLP domains
Includes a CD with hundreds of practice exam questions and answers

The CSSLP Prep Guide prepares you for the certification exam and career advancement.

Get 16% OFF

Click here for more information about The CSSLP Prep Guide: Mastering the Certified Secure Software Lifecycle Professional

Read More...

Writing Secure Code, Second Edition Review

Average Reviews:

(More customer reviews)The title of the book is misleading to begin with. The book is not about writing secure code. It's about (1) not writing non-secure code and (2) using Windows specific security APIs.
(1) Not writing non-secure code. Covers several issues, some more obvious, like buffer overruns and validating user input, some more complex, like escaping URLs and socket security. I thought the book would teach me best practices about organizing code, as in "do like I do". Instead it goes like "don't do like I'm telling you".
(2) Using Windows security APIs. This is THE BEST part of the book. Gives you a very good overview about several different APIs, including ACLs, protecting sensitive data, securing DCOM and .NET code, excellent tips on installing programs etc. etc.
Keep in mind that this book is said to be used internally within Microsoft with "security pushes", with the audience of 8000 people, including not only developers of all levels, but managers as well, therefore the book is by definition a high level overview.
Sometimes the book feels like MS educational course. Ex. (tip on p.77) "I created the ... diagrams ... using ... Microsoft Visio Professional 2002". That's cool, but what does it have to do with security ?
Some topics should never be there. How about 3 pages of tips for a kernel driver writer ? It's a huge topic in itself and how many readers outside MS do this anyway ? Privacy issues are covered idealistically. Yeah, sure, if you put a specially crafted XML to the special place on your site, the users magically start trusting you... I'd better read about real situation with privacy, not how the government rules it to be. Oh, and how about 40 pages about cryptography ? Please...
The book tries to show you the security process with development and testing. I can easily see they use this process in Microsoft, with 8000 people. For a small team it's completely useless. How about using 4 (!) people for a code review ? Sure, upon reading this book you will know that security code review is a must (if you have enough resources). Didn't you know that before ?
The code samples are ugly. How about this: "... X is cool ... several pages of Perl (!) ... see what I mean ?". Ok, one of the authors admits to be a Perl fan, but how am I supposed to read through all this gibberish ? C(++) samples are not much better. May be they are fully functional and compilable and all, but please, they are huge and inconsistent in themselves.
All in all, 5 stars for Microsoft, 3 stars for the rest of the world.

Click Here to see more reviews about: Writing Secure Code, Second Edition

Get 43% OFF

Click here for more information about Writing Secure Code, Second Edition

Read More...