Software Security

As a public good, open-source software is supported by diverse and wide-ranging communities—which are composed of individual maintainers, non-profit software foundations, and corporate stewards. CISA must integrate into and support these communities, with a particular focus on the critical OSS components that the federal government and critical infrastructure systems rely upon.

Immerse yourself in the world of software security with the new eBook "Secure Development." This comprehensive guide provides meticulous insights into the creation of secure, resilient applications, addressing common misconceptions and guiding you through the foundations of application security. Learn to understand, anticipate, and mitigate application attacks, and master the basic principles of creating a robust defense system for your software. Delve into the specifics of secure designing that can inhibit cyber attackers from exploiting your application. From minimizing the attack surface...

In this comprehensive guide, authors Kelly Shortridge and Aaron Rinehart help you navigate the challenges of sustaining resilience in complex software systems by using the principles and practices of security chaos engineering. By preparing for adverse events, you can ensure they don't disrupt your ability to innovate, move quickly, and achieve your engineering and business goals.

Learn application security from the very start with this comprehensive and approachable guide. Alice and Bob Learn Application Security is an accessible and thorough resource for anyone seeking to incorporate, from the beginning of the System Development Life Cycle, best security practices in software development. This book covers all the basic subjects such as threat modeling and security testing, but also dives deep into more complex and advanced topics for securing modern software systems and architectures.

Spring in Action, Fourth Edition is a hands-on guide to the Spring Framework, updated for version 4. It covers the features, tools, and practices including Spring MVC, REST, Security, Web Flow, and more. You'll move between short snippets and an ongoing example as you learn to build simple and efficient J2EE applications. Author Craig Walls has a special knack for crisp and entertaining examples that zoom in on the features and techniques you really need.

2025 Expanded Edition Your Ultimate Guide to Mastering Modern Cybersecurity 🔒 Do you want to dive into cybersecurity, from basic concepts to advanced strategies? Are you a developer, tech enthusiast, or IT specialist looking to elevate your skills and expertise to the next level? Interested in exploring data protection, securing networks, hacking strategies, and uncovering advanced cybersecurity insights? Authored by Shawn Walker, a seasoned expert in cybersecurity, this comprehensive handbook offers practical, real-world strategies to protect against the serious consequences of security...

Dive into the world of programming with "The Art of C Programming" - a comprehensive guide that will empower you to unleash the full potential of the powerful C programming language. If you're a beginner embarking on your coding journey or an experienced programmer seeking to improve your skills, this eBook has got you covered! The Art of C Programming meticulously takes you through a vast range of C programming concepts that cover everything from syntax, datatypes, and variables, to advanced topics such as multithreading, networking applications, and graphical user interfaces. This ...

Modern society relies heavily on software-based automation, implicitly trusting developers to write software that operates in the expected way and cannot be compromised for malicious purposes. While developers often perform rigorous testing to prepare the logic in software for surprising conditions, exploitable software vulnerabilities are still frequently based on memory issues. Examples include overflowing a memory buffer and leveraging issues with how software allocates and de-allocates memory.

Duqu, the infamous malware from the Stuxnet family, made its return. First discovered in October 2011, Duqu was actively spying on digital certificate issuing authority in Hungary. As soon as it was exposed, the malware was abandoned by its originators. Information security companies added it to a “blacklist” database of anti-virus software. After that initial discovery, Duqu had been out of the spotlight for almost four years, until one of the biggest names in cyber-security, Kaspersky Lab, announced that it had detected the presence of the Duqu malware. On June 10, 2015, Kaspersky Lab...

20 Critical Steps to Cybersecurity Safety gives vital information about how to stay safe while working online. Whether you’re moonlighting or working as a full-time freelancer, protecting yourself online through a well-constructed cybersecurity strategy is essential. Moreover, now is the time to do it. After all, attackers are targeting small businesses and sole traders like never before. In 2018, there was a 424% increase in attacks in this arena. Worse still, the impacts for most freelancers would be catastrophic. A comprehensive strategy is the only solution.

Docker in Action teaches listeners how to create, deploy, and manage applications hosted in Docker containers. After starting with a clear explanation of the Docker model, you will learn how to package applications in containers, including techniques for testing and distributing applications. You will also learn how to run programs securely and how to manage shared resources. Using carefully designed examples, the book teaches you how to orchestrate containers and applications from installation to removal.

Most books sell you the dream—this one hands you the map through the minefield. Master the skills and knowledge you need to succeed as a software engineer with this comprehensive guide. Whether you're new to the field or a seasoned professional, this book covers all the essential software development topics to help you stay up-to-date and excel in your role. Click the Read sample button (under the cover image on the left) to see the extensive list of topics covered in the table of contents. This comprehensive guide covers essential topics in software engineering/software development. Read...

Unmitigated vulnerabilities in the software supply chain continue to pose a significant risk to organizations and our nation. This paper builds on the previously released Recommended Practices Guide for a software supply chain’s development, production and distribution, and management processes, to further increase the resiliency of these processes against compromise.

Amazon Web Services in Action introduces you to computing, storing, and networking in the AWS cloud. The audiobook will teach you about the most important services on AWS. You will also learn about best practices regarding security, high availability, and scalability.

Welcome to the wonderful world of hacking, a seemingly magical world, crafted out of the heart of mystery and wonder, but an oh so very real world where those who hesitate for even just a moment end up in very deep doo-doo, and only the elite have what it takes to survive!

This fact sheet will assist with better management of risk from OSS use in OT products and increase resilience using available resources. While several resources and recommendations within this fact sheet are best suited for execution by the vendor or the critical infrastructure owner, collaboration across parties will result in less friction for operator workflows and promote a safer, more reliable system and provision of National Critical Functions.

Have you always been interested in the world of programming? If you want to learn the programming languages for beginners or the professional hacking techniques, then this is the perfect audiobook for you. This audiobook includes: SQL Computer Programming for Beginners, Python for Beginners, Kali Linux and Hacking with Kali Linux.

A former US Navy intelligence officer, David Locke Hall was a federal prosecutor when a bizarre-sounding website, CRACK99, came to his attention. It looked like Craigslist on acid, but what it sold was anything but amateurish: thousands of high-tech software products used largely by the military, and for mere pennies on the dollar. Want to purchase satellite tracking software? No problem. Aerospace and aviation simulations? No problem. Communications systems designs? No problem.

Have you watched the news lately? They can't stop talking about hacking. It is portrayed in movies, shouted about in media headlines, and typically gets a lot of attention. In fact, in the run up to the 2016 US Presidential election, there were allegations made nearly every day that the Russians were influencing the election by hacking into American databases and systems. And who can forget Julian Assange and his infamous WikiLeaks that successfully hacked into hundreds of thousands of emails, and whose actions may have kept Hillary Clinton out of the White House.

The dramatic increase in cyber compromises over the past five years, specifically of software supply chains, prompted intense scrutiny of measures to strengthen the resilience of supply chains for software used throughout government and critical infrastructure. Several policies and working groups at multiple levels within the U.S. Government focus on this need to ensure the authenticity, integrity, and trustworthiness of software products.