Welcome to MSDN Blogs Sign in | Join | Help

Michael Howard's Web Log

A Simple Software Security Guy at Microsoft!
The 19 Deadly Sins of Software Security

After much blood, sweat and tears, a new software security book, written by me, David LeBlanc and John Viega went to the printers today, and should be available in time for Blackhat :) It has the ever-so catchy title of "The 19 Deadly Sins of Software Security."

Y'all probably know David, he was the co-author of Writing Secure Code with me. John is an old hat at this security stuff too, he's written a bunch of books mainly focusing on open source security, including Building Secure Software, Network Security OpenSSL and Secure Programming Cookbook for C and C++.

So why on earth did we write another book on the subject? Easy, we wanted a book the industry could use, John's an open source guy and David and I are primarily Windows guys and we wanted to create book that covered all popular languages *C, C++, C#, Java, PHP, Perl, VB etc) and all popular platforms (Windows, Linux, Unix and Mac OS X.)

The book is carved up into 19 chapters, or Sins, and each is only 10-15pp long. The Sins are:

  1. Buffer Overflows
  2. Format String problems
  3. SQL injection
  4. Command injection
  5. Failure to handle errors
  6. Cross-site scripting
  7. Failing to protect network traffic
  8. Use of "magic" URLs and hidden forms
  9. Improper use of SSL
  10.  Use of weak password-based systems
  11.  Failing to store and protect data
  12.  Information leakage
  13.  Improper file access
  14.  Integer range errors
  15.  Trusting network address information
  16.  Signal race conditions
  17.  Unauthenticated key exchange
  18.  Failing to use cryptographically strong random numbers
  19.  Poor usability

Each chapter is carved into the following sections:

Overview
A brief introduction to the problem, not too deep, limited to 6-12 paragraphs.

The Sin Explained
The core essence of the defect, what is the principle mistake that makes this A Bad Thing?

Sample Code Defect
Sample code. Use at least two languages if possible, and show variations if possible too.

Spotting the Defect Pattern
Outside of the defect itself, what designs must a developer follow to lead up to the vulnerability?

Spotting the Defect during Code Review
What to look for in code to spot the flaw. Remember, developers are time constrained, and in many instances knowledge constrained too, so anything you can do to make this step easier is good!

Testing the Defect during Test
Tools and techniques you can use to test for this kind of defect.

Example Defects
Examples from CVE or SecurityFocus of this kind of defect, with some commentary from us.

Redemption Steps
How to fix the problem in code. Once again, show many languages, and if possible, variants.

Extra Defensive Measures
Other defenses you can put in place that do not fix the problem, but may make it harder for a bad guy to exploit a potential defect.

Other Resources
Book chapters, web links etc.

Summary
A list of DO’s, DO NOT’s and CONSIDER’s

A critical design goal, from the outset, was to be short and to the point; no war stories, no gossip, just the facts.

We're very happy with this book, it's the first book to focus on the broad industry-wide issue of security and we believe it covers *ALL* the bases.

http://www.amazon.com/exec/obidos/tg/detail/-/0072260858
Posted: Monday, July 11, 2005 9:10 PM by michael_HOWARD
Filed under:

Comments

Sushant Bhatia said:

Can we see examples of the 19 sins in C# as an example?
# July 12, 2005 1:15 AM

LarryOsterman said:

Ordered :)
# July 12, 2005 1:19 AM

Dana Epp's ramblings at the Sanctuary said:

Ahhhhh... it was time for me to read a new software security book. I was just thinking about what was next to read. Tonight Michael Howard helped me out and told the world about a new book that he, David LeBlanc and John Viega have finished writing called "The 19 Deadly Sins of Software Security". The book is carved up into 19 chapters, or Sins, and each is only 10-15pp long. The Sins are: Buffer Overflows Format String problems SQL injection Command injection Failure to handle errors Cross-site scripting Failing to protect network traffic Use of "magic" URLs and hidden forms Improper use of SSL Use of weak password-based systems Failing to store and protect data Information leakage Improper file access Integer range errors Trusting network address information Signal race conditions Unauthenticated key exchange Failing to use cryptographically strong random numbers Poor usability These three guys have contributed to some of my favorite writings. I look forward to getting my hands on a copy....
# July 12, 2005 1:51 AM

Ilya said:

Chapter 18 rather should be "Failing to use cryptography in a proper way" though :) Random numbers is a way too narrow spot at the whole subject's blunders.
# July 12, 2005 2:50 AM

Uwe Hermann said:

Michael Howard, David LeBlanc and John Viega have written a book called The 19 Deadly Sins of Software Security, which is to be published soon.
It explains the most important security issues one encounters in the software industry in a Design Patterns-lik
# July 12, 2005 4:52 AM

Brian Lounsberry said:

The work you did on WSC was eye opening and great stuff. However, I like the format you've chosen for this. You guys have this down to a science. I can't wait!
# July 12, 2005 9:14 PM

Productivity Hacks said:

Michael Howard, Microsoft's security expert, is working on a new book called The 19 deadly sins of software security. Get a copy for your IT guy. Here are Howard's deadly sins: 1. Buffer Overflows 2. Format String problems 3. SQL...
# July 12, 2005 9:25 PM

OpsanBlog said:

# July 12, 2005 10:57 PM

Sergey Simakov blog said:

# July 13, 2005 10:50 AM

Rob Caron's Blog said:

Visual Studio Team System

There’s a new Team System community site – TeamSystemRocks.com! ⊕
Well,...
# July 14, 2005 9:35 PM

michaelsilk said:

how can you say it's aimed a 'all languages' and then put the #1 'sin' as "buffer overflow" and #2 as format string!!

not really that language independant (so don't try to be ..?!).

jmo.
# July 21, 2005 3:43 AM

SATISH BHARDWAJ said:

Congratulations to the writer of the book "19 deadly sins". I'm probably wasting my time making my comments which are not an attack on his book or on his idea. My comments are basically on the refusal of everypne to recognize that the hackers operate not because of the foolishness of anyone as the book implies. It is because the present system of browsing the net gives to much power who has money to buy any personal coputer that is powered by any browser. The web surfer can use any security system he can find on the net. If he is clever like the writer of the "19 deadly sins" he will device his own security software and market it through Amazon like our friend Michael does and become rich. May be not overnight but eventually.

Unless this power is taken away from the Hackers the security systems will do no good. The hackers job is relatively easy. It is to convince the servers that the request for any information is legitemate. There are no holds barred by the request for inormation. Perhaps Michael would agree with me that this is the job of the server. Send the files to the clients. But may be Michael would not agree with me. In that case I'd ask him to tell me and others what, in his view, is the job of the server?

Unless the job of the server is changed, basically by the rewriting of the code, there is no hope for the people who keep their files on the internet.

<a href="http://www.hackers10.blogspot.com/">STOP THE HACKER</a>

Perhaps I should have called my blog "ONLY ONE WAY TO STOP THE HACKERS.
# July 26, 2005 3:39 PM

Sergey Kostrukov said:

Bla, Bla, Bla...

I has read "Writing Secure Code" book, and was interested. - thanks, Michael, for the good book.

I'll keep waiting, when this book will be published in Russian.
# July 31, 2005 7:18 AM

Stuart Celarier said:

Here's an invaluable resource...an article by Michael Howard titled Browsing the Web and Reading E-mail Safely as an Administrator. The article includes a great application called DropMyRights that lets a user who is running as administrator run applications in the much safer context of a non-administrator...
# August 2, 2005 1:09 PM

Yves Hanoulle: Project Complete said:

# August 9, 2005 5:05 PM

Yves Hanoulle: Project Complete said:

# August 9, 2005 5:08 PM

Yves Hanoulle: Project Complete said:

# August 9, 2005 5:14 PM

Yves Hanoulle: Project Complete said:

# August 9, 2005 5:16 PM

Yves Hanoulle: Project Complete said:

# August 9, 2005 5:17 PM

Register Domain WebLog » Blog Archive » BNA's Web Watch -Data Security - April 2005 said:

PingBack from http://blogsseek.com/register-domain/2007/07/17/bnas-web-watch-data-security-april-2005/

# July 18, 2007 12:27 PM

Os formatadores de strings da Granja do Solar « sec::h0p /* by Alberto Fabiano */ said:

PingBack from http://sechop.wordpress.com/2007/11/05/os-formatadores-de-strings-da-granja-do-solar/

# November 7, 2007 7:03 PM

Os formatadores de strings da Granja do Solar « Inno::Blog /* by Alberto Fabiano */ said:

PingBack from http://techberto.wordpress.com/2007/11/07/os-formatadores-de-strings-da-granja-do-solar/

# November 7, 2007 7:15 PM

Os formatadores de strings da Granja do Solar « sec::h0p /* by Alberto Fabiano */ said:

PingBack from http://sechop.wordpress.com/2007/11/07/os-formatadores-de-strings-da-granja-do-solar/

# November 7, 2007 7:31 PM

Michael Howard’s Web Log : The 19 Deadly Sins of Software Security at Restaurants said:

PingBack from http://restaurants.247blogging.info/?p=468

# December 31, 2007 1:35 AM

Termékinformációk fejlesztőknek said:

[Nacsa Sándor, 2009. január 13. – február 3.]&#160; A minőségbiztosítás kérdésköre szinte alig ismert

# February 4, 2009 12:04 AM

Michael Howard s Web Log The 19 Deadly Sins of Software Security | Paid Surveys said:

PingBack from http://paidsurveyshub.info/story.php?title=michael-howard-s-web-log-the-19-deadly-sins-of-software-security

# May 29, 2009 12:16 PM

Michael Howard s Web Log The 19 Deadly Sins of Software Security | pool toys said:

PingBack from http://pooltoysite.info/story.php?id=8291

# June 18, 2009 4:37 AM
New Comments to this post are disabled
Page view tracker