Now that almost every device for which developers are generating code is connected to a network, and in most cases directly or indirectly to the Internet, it is essential for programmers to understand software security and how to protect against attack. Yet hardly a day goes by without a security incident of some kind, indicating that there is still a severe lack of security understanding in the software world.
This book goes a long way to addressing this shortfall and should be essential reading for every software developer.
Part one covers design principles: setting out the goals and how to design towards them. It also covers the well-intentioned but flawed approaches to security that lead to a false sense of security.
Part two explores all the major forms of attack and describes how to counter them including many examples of secure, and not so secure, code.
Part 3 is an Introduction to Cryptography and covers the subject in enough detail for the diligent designer to choose the correct encryption method.
Finally part 4 contains Appendices and references.
The book is well written and provides a broad subject matter while still containing enough detail to go from beginner to skilled practitioner.