Secure by Design

Summary

Secure by Design teaches developers how to use design to drive security in software development. This book is full of patterns, best practices, and mindsets that you can directly apply to your real world development. You'll also learn to spot weaknesses in legacy code and how to address them.

Foreword by Daniel Terhorst-North.

Purchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications.

About the Technology

Security should be the natural outcome of your development process. As applications increase in complexity, it becomes more important to bake security-mindedness into every step. The secure-by-design approach teaches best practices to implement essential software features using design as the primary driver for security.

About the Book

Secure by Design teaches you principles and best practices for writing highly secure software. At the code level, you'll discover security-promoting constructs like safe error handling, secure validation, and domain primitives. You (TM)ll also master security-centric techniques you can apply throughout your build-test-deploy pipeline, including the unique concerns of modern microservices and cloud-native designs.

What's inside

• Secure-by-design concepts
• Spotting hidden security problems
• Secure code constructs
• Assessing security by identifying common design flaws
• Securing legacy and microservices architectures

About the Reader

Readers should have some experience in designing applications in Java, C#, .NET, or a similar language.

About the Author

Dan Bergh Johnsson, Daniel Deogun, and Daniel Sawano are acclaimed speakers who often present at international conferences on topics of high-quality development, as well as security and design.

Table of Contents

PART 1 - Introduction
1. Why design matters for security
2. Intermission: The anti-Hamlet
PART 2 - Fundamentals
3. Core concepts of Domain-Driven Design
4. Code constructs promoting security
5. Domain primitives
6. Ensuring integrity of state
7. Reducing complexity of state
8. Leveraging your delivery pipeline for security
9. Handling failures securely
10. Benefits of cloud thinking
11. Intermission: An insurance policy for free
PAT 3 - Applying the fundamentals
12. Guidance in legacy code
13. Guidance on microservices
14. A final word: Don't forget about security