Channels ▼


Three Angles on Security

Gregory V. Wilson is a contributing editor to Dr. Dobb's Journal. He can be contacted at

Secure Programming with Static Analysis
Brian Chess and Jacob West
Addison-Wesley Professional, 2007
624 pp., $44.99
ISBN 0321424778

Security Data Visualization: Graphical Techniques for Network Analysis
Greg Conti
No Starch Press, 2007
272 pp., $49.95
ISBN 1593271433

Exploiting Online Games: Cheating Massively Distributed Systems
Greg Hoglund and Gary McGraw
Addison-Wesley Professional, 2007
384 pp., $44.99
ISBN 0132271915

Plane flights are a great way to catch up on my reading, though they play hell with my back. I got through two and a half books on my way to and from the west coast last week, and finished the last one while eating handfuls of Vitamin I (i.e., Ibuprofen). One of the three was very good, and the other two were certainly worth reading, so herewith the reviews.

The best of the three was Brian Chess and Jacob West's Secure Programming with Static Analysis. The authors work for Fortify Software, which (unsurprisingly) builds and sells static analysis tools to help programmers identify security holes in their code. Here, "static analysis" means "what you can find out by analyzing the program's source, rather than by running it". It's a rich and complicated field, full of undecidable problems, but the authors make the core concepts accessible by grounding them in real-world problems. What data structures do analysis tools use to represent programs? How does Perl's "taint mode" trace user-entered values through a program? Perhaps most importantly, how can you incorporate static analysis into your regular build and QA cycles, so that problems are caught and corrected before they reach the customer?

Readers will need a basic understanding of how compilers, call stacks, and pointers work to follow the discussion, but anyone who has ever forked a process or opened a socket should be okay. If you're not, now's the time to go back to your old textbooks and refresh your memory: tools like the ones discussed in this book are quickly becoming part of the mainstream, and developers who don't know how to drive them will soon find themselves in the same bucket as ones who never got on top of HTTP, or still aren't quite sure what a design pattern is.

Second on my list was Greg Conti's Security Data Visualization: Graphical Techniques for Network Analysis. As you'd guess from the title, Conti believes that developers and administrators can, and should, use data visualization to monitor and improve computer security. After a fairly slow-moving introduction, he presents a series of increasingly complicated case studies: An attack (or possible attack), a way of representing the key data pictorially, and then some analysis. Conti even includes a chapter on how to attack security visualizations, i.e., ways of pushing data into them that mask the signal of an attack. I'm not entirely convinced that the techniques he describes will scale to very large systems, but there are so many holes in small ones that I probably shouldn't worry.

The last book of my trip was Greg Hoglund and Gary McGraw's Exploiting Online Games: Cheating Massively Distributed Systems. It's a timely topic: More and more real money is tied up in virtual economies, and online gambling (particularly poker) is a multi-billion dollar industry. I also think it's a great way to introduce security to students, many of whom spend as much time in the world of Warcraft as they do in this one.

The book covers a lot of important issues. It also includes a refreshing amount of nitty-gritty detail, much of which assumes in-depth knowledge of C/C++ Windows programming. But there was a little too much "gosh wow!" for my liking. Page 85 is just one example: Are all those exclamation marks really necessary!!?? A sterner editor, and a little less self-reference, would have made this a stronger book, but even with its flaws, it's a much better investment of time than Air Canada's in-flight entertainment.

Related Reading

More Insights

Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

Dr. Dobb's encourages readers to engage in spirited, healthy debate, including taking us to task. However, Dr. Dobb's moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing or spam. Dr. Dobb's further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.