APPLICATION SECURITY BOOK EXCERPTS
Security Metrics: Replacing Fear, Uncertainty, and Doubt -- Chapter 3, Application Security Metrics
Andrew Jaquith
04.04.2007
Rating: -4.50- (out of 5)
As a registered member of SearchAppSecurity.com, you're entitled to a complimentary excerpt from Security Metrics: Replacing Fear, Uncertainty, and Doubt written by Andrew Jaquith and published by Addison Wesley Professional.
This excerpt specifically addresses application security metrics. Jaquith discusses how to measure the security of an application and outlines three methods: by counting remotely and locally exploitable flaws without knowledge of the code (black-box metrics), by counting design and implementation flaws in the code (code security metrics) and by creating qualitative risk indices using a weighted scoring system (qualitative process metrics and indices).
Book description:
Security Metrics is the first comprehensive best-practice guide to defining, creating and utilizing security metrics in the enterprise.
Using sample charts, graphics, case studies and war stories, Yankee Group Security Expert Andrew Jaquith demonstrates exactly how to establish effective metrics based on your organization's unique requirements. You'll discover how to quantify hard-to-measure security activities, compile and analyze all relevant data, identify strengths and weaknesses, set cost-effective priorities for improvement and craft compelling messages for senior management.
Security Metrics successfully bridges management's quantitative viewpoint with the nuts-and-bolts approach typically taken by security professionals. It brings together expert solutions drawn from Jaquith's extensive consulting work in the software, aerospace, and financial services industries, including new metrics presented nowhere else. You'll learn how to do the following:
- Replace nonstop crisis response with a systematic approach to security improvement
- Understand the differences between "good" and "bad" metrics
- Measure coverage and control, vulnerability management, password quality, patch latency, benchmark scoring, and business-adjusted risk
- Quantify the effectiveness of security acquisition, implementation, and other program activities
- Organize, aggregate, and analyze your data to bring out key insights
>> Read the excerpt on application security metrics.
>> Buy the book
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSoftwareQuality.com.
Register now
to start rating these tips. Log in if you are already a member.
|
 |
 |
| |
RELATED CONTENT
 |
Application Security Book Excerpts |
|
Software Security Engineering: A Guide for Project Managers -- Chapter 3, Requirements Engineering for Secure Software
|
|
InfoSecurity 2008 Threat Analysis, Chapter 4: XSS Theory
|
|
Google Hacking for Penetration Testers, Volume 2: Chapter 6, Locating Exploits and Finding Targets
|
|
Ajax Security -- Chapter 6, Transparency in Ajax Applications
|
|
Fuzzing: Brute Force Vulnerability Discovery -- Chapter 12, Fuzzing Frameworks
|
|
Cross Site Scripting Attacks: XSS Exploits and Defense -- Chapter 5, Advanced XSS Attack Vectors
|
|
Static Analysis as Part of the Code Review Process -- Chapter 3, Secure Programming with Static Analysis
|
|
Forms Authentication -- Chapter 5, Professional ASP.NET 2.0 Security, Membership, and Role Management
|
|
Securing JavaServer Faces Applications -- Chapter 15, JavaServer Faces: The Complete Reference
|
|
Hacking for Dummies -- Chapter 16, Web applications
|
|
Security Methods |
|
Software Security Engineering: A Guide for Project Managers -- Chapter 3, Requirements Engineering for Secure Software
|
|
Google Hacking for Penetration Testers, Volume 2: Chapter 6, Locating Exploits and Finding Targets
|
|
Ajax Security -- Chapter 6, Transparency in Ajax Applications
|
|
Fuzzing: Brute Force Vulnerability Discovery -- Chapter 12, Fuzzing Frameworks
|
|
Static Analysis as Part of the Code Review Process -- Chapter 3, Secure Programming with Static Analysis
|
|
Forms Authentication -- Chapter 5, Professional ASP.NET 2.0 Security, Membership, and Role Management
|
|
Securing JavaServer Faces Applications -- Chapter 15, JavaServer Faces: The Complete Reference
|
|
Hacking for Dummies -- Chapter 16, Web applications
|
|
Penetration testing techniques -- Chapter 6, Professional Pen Testing for Web Applications
|
|
Ajax in Action -- Chapter 7, Security and Ajax
|
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
