Security certificates for Programming

[krwell]

Hey guys I'm a programmer and with all the talk about security and all the jobs being shipped overseas I thought it would be best if I learned everything I could about security in code and programs. Any good places to start or anything good to learn?

 

[Nothinman]

First thing is to make sure you never buy the book "Writing Secure Code" by Microsoft Press...

 

[Barnaby W. Füi]

Zing!

I dunno about certificates, but there's lots of good info on the web, and at least one book I can remember hearing about.

 

[Descartes]

I would start with The Sans Reading Room. There are countless other resources as BBWF said, but SANS should give you a starting point. "Security" is really a broad scope of knowledge, so it would be better if you picked a certain facet of particular interest and started there. For example, are you a developer or an administrator?

Originally posted by: Nothinman
First thing is to make sure you never buy the book "Writing Secure Code" by Microsoft Press...

Seriously, your myopic anti-MS drivel can be overwhelmingly annoying at times. Writing Secure Code is an absolutely fantastic book. Don't discount the works of excellent authors simply because it's published by MS Press.

 

[Barnaby W. Füi]

Perfect timing

 

[Nothinman]

Seriously, your myopic anti-MS drivel can be overwhelmingly annoying at times. Writing Secure Code is an absolutely fantastic book. Don't discount the works of excellent authors simply because it's published by MS Press.

You need a better sense of humor then. It was a joke without the trailing I don't even know if the author works at MS other than as a writer, I just found it amusing that they published a book on secure programming that obviously noone in their company has read.

 

[Descartes]

Originally posted by: Nothinman

Seriously, your myopic anti-MS drivel can be overwhelmingly annoying at times. Writing Secure Code is an absolutely fantastic book. Don't discount the works of excellent authors simply because it's published by MS Press.

You need a better sense of humor then. It was a joke without the trailing I don't even know if the author works at MS other than as a writer, I just found it amusing that they published a book on secure programming that obviously noone in their company has read.

The trailing changes the semantics of the whole sentence, so I just took it at face value (pun intended).

To author an MS Press book you need not be an MS employee. A lot of the authors are just outside consultants who are commissioned to write the books. Admonish MS all you want for their past security policies (or lack thereof), but there is a concerted effort to turn things around.

 

[Nothinman]

To author an MS Press book you need not be an MS employee. A lot of the authors are just outside consultants who are commissioned to write the books.

I figured as much, just like their hardware and pretty much everything but the software they produce. It's just got their name on it.

Admonish MS all you want for their past security policies (or lack thereof), but there is a concerted effort to turn things around.

I know, I've seen Win2K3 and I was surprised at how good a job they did setting almost everything up like I usually do. Instead of 20 minutes of fixing stupid defaults it was like 2. But I still think a big problem is the ease of use they push, it makes people think they're administrators when they're really not. For instance a friend of mine recently started playing with Win2K3 and AD at home, that in itself isn't a problem but I know he did nothing more security-wise than go through the add role wizards. Just for internal AD/DHCP/DNS this isn't a problem but he spoke of trying to setup Exchange next and running a personal mail server and that has a lot more potential to be a problem.

In addition to that his Cisco DSL router has the default telnet and enable password, when I told him I could get into his router from anywhere on the Internet he said "but that's not an issue because they don't know I have a Cisco router", after I ran nmap on his router and showed him that it even displayed the model number (the new nmap OS detection code is bad ass) he didn't reply because he just don't really care. And that's a problem with a lot of MS clients, they buy the software hoping to get a quick server setup for something and don't care to set it up right. That's not MS' fault, but they make it too easy for them to setup poorly secured boxes. Atleast with Linux if you don't have the dedication to read the documentation you don't have a chance of getting it setup at all =)

 

[krwell]

I'm looking for more security in being a software developer, not a network admin.

 

[Nothinman]

I'm looking for more security in being a software developer, not a network admin.

I know, the book were were talking about originally was a programming book, I just got off on a tangent.