Marke: Federico Coletto
Variante: Taschenbuch
Eigenschaften:
Cybersecurity is no longer just a “feature” — it is a fundamental requirement of modern engineering. In an era of escalating threats and rigorous new regulations, building software that is secure by design and by default is not just a best practice; it is a necessity for business success.This book, part of “The Defender’s Mindset” series, provides a practical roadmap to professional-grade security. Moving beyond abstract theory, it offers a hands-on exploration of real-world attack patterns and the concrete strategies needed to mitigate them.The volume is composed by 4 main sections:Section 1: Cybersecurity Fundamentals → A simplified, bare-bone version of central cybersecurity topics. It covers the concept of Cybersecurity Posture, the Defense in Depth principle, and international standards such as:CWE - Common Weaknesses Enumeration (https://cwe.mitre.org/)CVE - Common Vulnerabilities and Exposures (https://www.cve.org/)CVSS - Common Vulnerability Scoring System (https://www.first.org/cvss/)IEC 62443 (https://www.isa.org/) Section 2: Quality Assurance Fundamentals → Focuses on the most useful and practical methodologies and tools required for secure development. Topics include SAST, DAST, and the Secure Software Development Lifecycle (SSDLC). Section 3: Hall of Fame → An exploration of high-impact flaws and scenarios Section 4: Vulnerabilities & Mitigations → The core of the book, which applies the previously discussed principles to demonstrate specific ways to mitigate dangerous defects and vulnerabilities that could be exploited by malicious actors. Its contents are organized in eight subsections:Memory and Resource ManagementInjection and Data NeutralizationAuthentication and AuthorizationCryptography and Data ProtectionInformation Disclosure and LoggingConcurrency and (Multi)ThreadingLogic Design, Control Flow and Supply ChainError Handling and Code QualityEach section analyses multiple vulnerabilities and their possible mitigations from the point of view of the CWEs that best fit their patterns. Along with the code samples, you will also find:A list of related CVEs of known exploitable vulnerabilities along with their CVSS.Regulatory and standard violations, mainly in the context of the IEC 62443 and in some instances, also EU NIS2 and EU Cyber Resilience Act.Whether you are an architect securing industrial automation systems or a developer building cloud APIs, this guide equips you with the “The Defender’s Mindset” required to transform potential vulnerabilities into robust, resilient, and high-quality software.
