
Average Reviews:

(More customer reviews)To begin with, in my opinion this book is an excellent source and practice oriented reference for understanding the fundamentals of Secure Software Development. It is written in a very understandable way such that I believe that security professionals, developers, software architects, as well as IT managers could profit from reading it. The book, which comes to my regret without CD, is structured as follows (i.e., CSSLP domains):
1. Secure Software Concepts
Good explanation of standards, best practices, methodologies, and frameworks. Regulations and Trusted Computing Base (TCB) are very much like in the CISSP books.
2. Secure Software Requirements
Again good description of Authentication and Protection Needs Elicitation (PNE). Authorization is the same as for CISSP.
3. Secure Software Design
Threat Modeling, architecture, and technologies are very well laid out.
4. Secure Software Implementation
Development methodologies, vulnerabilities, and defensive techniques are thoroughly discussed. The complete list of OWASP vulnerabilities is shown and possible counter measures proposed. Personally, chapters 3 and 4 are the ones I appreciated the most in this book.
5. Secure Software Testing
Testing methods are listed in detail. Good part.
6. Software Acceptance
This chapter is mainly about Change Management and Intellectual Property Rights in all its flavours (again, the latter reminded me of CISSP CBK).
7. Software Deployment
Subjects like installation, maintenance, incident and problem management, and disposal are well addressed (parts of this content can be found in CISSP literature).
Conclusion
I recommend this book as an excellent reference guide to software security. Personally, I would have wished it to include a CD which makes it so much easier to search for keywords. I would guess that about one third of this book's content is already covered by CISSP CBK. But this is due to (isc)2's strategic decision and does not decrease my appreciation for the book in question. For the time being, I have not yet taken the CSSLP exam and, hence, cannot judge its potential with regard to the exam preparation. This is why I give it only 4 stars instead of 5.
Click Here to see more reviews about:
Official (ISC)2 Guide to the CSSLP ((ISC)2 Press)As the global leader in information security education and certification, (ISC)2 has a proven track record of educating and certifying information security professionals. Its newest certification, the Certified Secure Software Lifecycle Professional (CSSLP) is a testament to the organization's ongoing commitment to information and software security.The Official (ISC)2 Guide to the CSSLPprovides an all-inclusive analysis of the CSSLP Common Body of Knowledge (CBK). As the first comprehensive guide to the CSSLP CBK, it facilitates the required understanding of the seven CSSLP domains-Secure Software Concepts, Secure Software Requirements, Secure Software Design, Secure Software Implementation/Coding, Secure Software Testing, Software Acceptance, and Software Deployment, Operations, Maintenance and Disposal-to assist candidates for certification and beyond. Serves as the only official guide to the CSSLP professional certificationDetails the software security activities that need to be incorporated throughout the software development lifecycleProvides comprehensive coverage that includes the people, processes, and technology components of software, networks, and host defenses Supplies a pragmatic approach to implementing software assurances in the real-worldThe text allows readers to learn about software security from a renowned security practitioner who is the appointed software assurance advisor for (ISC)2. Complete with numerous illustrations, it makes complex security concepts easy to understand and implement. In addition to being a valuable resource for those studying for the CSSLP examination, this book is also an indispensable software security reference for those already part of the certified elite. A robust and comprehensive appendix makes this book a time-saving resource for anyone involved in secure software development.

Click here for more information about Official (ISC)2 Guide to the CSSLP ((ISC)2 Press)