Short description:

As the Internet has evolved, so have the various vulnerabilities, which largely stem from the fact that developers are unaware of the importance of a robust application security program. This book aims to educate readers on application security and building secure web applications using the new Java Platform.

Long description:

Most security books on Java focus on cryptography and access control, but exclude key aspects such as coding practices, logging, and web application risk assessment. Encapsulating security requirements for web development with the Java programming platform, Secure Java: For Web Application Development covers secure programming, risk assessment, and threat modeling explaining how to integrate these practices into a secure software development life cycle.

From the risk assessment phase to the proof of concept phase, the book details a secure web application development process. The authors provide in-depth implementation guidance and best practices for access control, cryptography, logging, secure coding, and authentication and authorization in web application development. Discussing the latest application exploits and vulnerabilities, they examine various options and protection mechanisms for securing web applications against these multifarious threats. The book is organized into four sections:



Provides a clear view of the growing footprint of web applications
Explores the foundations of secure web application development and the risk management process
Delves into tactical web application security development with Java EE
Deals extensively with security testing of web applications


This complete reference includes a case study of an e-commerce company facing web application security challenges, as well as specific techniques for testing the security of web applications. Highlighting state-of-the-art tools for web application security testing, it supplies valuable insight on how to meet important security compliance requirements, including PCI-DSS, PA-DSS, HIPAA, and GLBA. The book also includes an appendix that covers the application security guidelines for the payment card industry standards.

Given that Java is the platform of choice for enterprise application development the world over, this book fills a much-needed gap by thoroughly and clearly outlining the security requirements of such a critical platform. I strongly believe that this work will prove invaluable to a wide audience, including Java developers, architects, and students.
?Kris Gopalakrishnan, CEO, Infosys Technologies Ltd.

? a great resource that covers all of the essential topics when building out an application security program.
?Ed Bellis, CISO, Orbitz Worldwide

Table of Contents:

The Internet Phenomenon. Introducing Information Security. Introducing Web Application Security. Web Application Security-A Case Study. FOUNDATIONS OF A SECURE JAVA WEB APPLICATION. Insights into Web Application Security Risk. Risk Assessment for the Typical E-Commerce Web Application. BUILDING A SECURE JAVA WEB APPLICATION. Developing a Bulletproof Access Control System for a Java Web Application. Application Data Protection Techniques. Effective Application Monitoring: Security Logging for Web Applications. Secure Coding Practices for Java Web Applications. TESTING JAVA WEB APPLICATIONS FOR SECURITY. Security Testing for Web Applications. Practical Web Application Security Testing. Appendix A: Application Security Guidelines for the Payment Card Industry Standards (PCI-DSS and PA-DSS).