Resources

Pointers to specific commercial and non-commercial material are provided at the risk of errors of omission. This is a very active field; it is likely impossible to develop comprehensive lists and such an attempt would distract from the ‘program level’ message of this site. The material is therefore presented in the spirit of “there is lots more where this came from.” The reader is urged to use Web search tools to look for additional resources that may better meet your needs.

Informational Web Sites

Tools

Static Code Analysis

Software Composition Analysis

Security Scanners

Dynamic Application Security Testing Tools

Training

There are a few vendors with focused but yet comprehensive application security material. For example:

You may find that one of these vendors can provide a one stop shop for application security training – especially if you are just kicking off a program.

Application security training is also available from a wide range of other free and commercial sources. All of the major commercial e-learning platforms have training in this space, but since their offerings tend to a lot broader you often need to search for what you want.

Security Services

These vendors generally have a portfolio of skills that can be applied to various needs such as:

  • Vulnerability Assessment & Penetration Testing
  • Threat modeling
  • Process review and improvement

Security Vendors

Top Application Security Vendors for 2021 | eSecurity Planet briefly repeats the portfolio statements for a number of different vendors. Two of them stand out for particularly broad portfolios (wide range of tools, Training, Consulting Services). If you are putting together a vendor selection matrix for a specific need, they can probably get you started with one or two columns:

Text Books

  • Secure Coding in C and C++, Robert C. Seacord. This textbook dives into the details of potential vulnerabilities in the C and C++ code that underlies the Linux operating system and many other important software systems. The depth and breadth of material make it a logical next step in training after available commercial web-based training; as a bonus the reader is almost certain to gain a better understanding of the languages themselves.
  • Writing Secure Code, Second Edition, Michael Howard and David LeBlanc. This book was originally published 20 years ago, but most of the material is as relevant today as it was then. The book covers ‘code-level’ issues but also lots of concerns at the design level. Coming out of Microsoft in the early 2000’s it is a bit MS-Windows centric in the examples. It is a “security classic;” something that security oriented professionals will appreciate. Today, it may not make sense to recommend it to a wider staff (as Microsoft did shortly after it was written).
  • The Security Development Lifecycle, Michael Howard. This excellent book introduced the Microsoft SDL to the outside world. The book is still available on the used market but unfortunately it is no longer in print. Fortunately Microsoft makes this material and much more available at their SDL site: https://www.microsoft.com/en-us/securityengineering/sdl
  • Cryptography and Network Security – Principles and Practice, William Stallings. This dense book is written in a fashion consistent with use in an upper or graduate level college course. It provides a strong background in Cryptography.
  • Threat Modeling: Designing for Security, Adam Shostack. This book out of Microsoft focuses on the STRIDE approach to threat modeling. The book does an excellent job of motivating threat modeling and then walking the reader through the mechanics of actually doing it. The material builds on the earlier presentation of threat modeling in Writing Secure Code. Microsoft has quite a lot of material on-line supporting it: https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling
  • Mastering Kali Linux for Advanced Penetration Testing – Third Edition, Vijay Kumar and Robert Beggs. This book is representative of a number of books on penetration testing (there is also a small industry creating pen-testing courseware). None of this material is going to make one a pen-testing expert but it does provide a good sense of the tools available to the offense and the basic approach to be followed.
  • Linux Forensics – with Python and Shell scripting, Dr. Philip Polstra. This book provides a reasonable overview of forensic mechanics.
  • Mastering Linux Security and Hardening: Protect your Linux System from malware attacks and other cyber threats – 2nd Edition, Donald A Tevault. This book reviews the many things that can be done to harden the OS. Much of this is configuration of the OS itself but some of it also impacts applications written on top of the OS.
  • Iron Clad Java: Building Secure Web Applications, Jim Manico and August Detlefen. This book is roughly the Java counterpart to Secure coding in C and C++.