The E-Lioners | Free Place For Everything

What is Software Security Building Security ?

Software is easy to criticize and hard to do. The bigger the software, the more that is true.
It is thus like speech—the more you say, the easier it is for the reader to find something
to criticize, and the more likely the critic will get it wrong. Brevity may be the soul of
wit, but it is wit that is the soul of brevity.
And, indeed, our software is nothing if not loquacious, slang-riven, ill-bred, bloated, and
raw. Is it any wonder that software is as prone to misinterpretation as is our language, any
wonder that our software, like our language, can be "twisted by knaves to make a trap for
fools?" No, it is not, but, as with language, everything we collectively are now depends
on software. Software is so very essential that it is unlikely that the world's population
would be as great as it now is without software—software to transport, to transact, to
transcribe, to translate, to transmit, to transform. In other words, the evidence is
unarguable that we have to get software right, just as the evidence is unarguable that
getting software right does not, and will not, come naturally.
As Dr. McGraw reminds us, breaking something is easier than designing something that
cannot be broken, though I personally prefer Sam Rayburn's earthy formulation, viz.:
"Any jackass can kick down a barn, but it takes a good carpenter to build one." And that
is what makes secure software in particular the pinnacle of concern because the very
definition of secure software is that it withstands sentient opponents. Parsing that
definition in its contrapositive: If a product does not have sentient opponents, then it does
not have security requirements. This is best examined by looking at why products fail—if
your product fails because of a collection of clueless users ("Hey, watch this!"), alpha
particles, or discharged batteries, security is not your issue. If your product fails because
some gleeful clown discovers that he can be the super-user by typing 5000 lowercase As
into some prompt, said clown may not be all that sentient, but nevertheless your product
has security requirements.
This can't be a completely bright line, but it is an instructive distinction. Secure software
is, by definition, designed with failure in mind. Secure software resists failure even when
that failure is devoutly wished for by the opponent. Secure software is designed for the
failure case as much as or more than the success case. Designers and implementers alike
envision an opponent who can think.
As Dr. McGraw says throughout this book, baking in security only happens when there is
intent to do so. My father used to scold me when my excuse for this or that was "I didn't
mean to do it, Daddy." His stinging comeback, for which I am a better man, was always
"But did you mean not to?" Given what I do for a living, I read vulnerability reports
every day. Every one of them says, "I didn't mean to do it, Daddy." Sometimes they even
try to say, "I didn't do it, but if I did I didn't mean to, and anyway you didn't notice, so all
you have to do is install this tiny little fix unless you want what happens next to be your
fault; aren't I a good boy?" I want to scream "Did you mean not to?" even though the
honest answer will at best be "I thought I meant not to."


Download Software Security Building Security by Gary McGraw

What Is Software Security by Micheal Howard Book ?

The material in this eBook also appears in the print version of this title: ISBN: 978-0-07-162675-0, MHID: 0-07-162675-1
All trademarks are trademarks of their respective owners. Rather than put a trademark symbol after every occurrence of a trademarked
name, we use names in an editorial fashion only, and to the benefit of the trademark owner, with no intention of infringement of the trademark.
Where such designations appear in this book, they have been printed with initial caps.
McGraw-Hill eBooks are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate
training programs. To contact a representative please e-mail us at bulksales@mcgraw-hill.com.
Information has been obtained by McGraw-Hill from sources believed to be reliable. However, because of the possibility of human or
mechanical error by our sources, McGraw-Hill, or others, McGraw-Hill does not guarantee the accuracy, adequacy, or completeness of
any information and is not responsible for any errors or omissions or the results obtained from the use of such information.
TERMS OF USE
This is a copyrighted work and The McGraw-Hill Companies, Inc. (“McGraw-Hill”) and its licensors reserve all rights in and to the work.
Use of this work is subject to these terms. Except as permitted under the Copyright Act of 1976 and the right to store and retrieve one
copy of the work, you may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative works based upon,
transmit, distribute, disseminate, sell, publish or sublicense the work or any part of it without McGraw-Hill’s prior consent. You may use
the work for your own noncommercial and personal use; any other use of the work is strictly prohibited. Your right to use the work may
be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL AND ITS LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS
TO THE ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE OBTAINED FROM USING THE WORK,
INCLUDING ANY INFORMATION THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR OTHERWISE,
AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill and its licensors do not
warrant or guarantee that the functions contained in the work will meet your requirements or that its operation will be uninterrupted or
error free. Neither McGraw-Hill nor its licensors shall be liable to you or anyone else for any inaccuracy, error or omission, regardless
of cause, in the work or for any damages resulting therefrom. McGraw-Hill has no responsibility for the content of any information
accessed through the work. Under no circumstances shall McGraw-Hill and/or its licensors be liable for any indirect, incidental, special,
punitive, consequential or similar damages that result from the use of or inability to use the work, even if any of them has been advised
of the possibility of such damages. This limitation of liability shall apply to any claim or cause whatsoever whether such claim or cause
arises in contract, tort or otherwise.

Download Software Security by Michael Howard,David LeBlanc, JohnViega

 What is Secure Coding Principles & Practices ?

This is book about Despite the myriad manifestations and different targets, nearly all
attacks on computer systems have one fundamental cause: the
code used to run far too many systems today is not secure. Flaws
in its design, implementation, testing, and operations allow
attackers all-too-easy access. Secure Coding: Principles &
Practices looks at the problem of bad code in a new way. Packed
with advice based on the authors' decades of experience in the
computer security field, this concise and highly readable book
explains why so much code today is filled with vulnerabilities, and
tells readers what they must do to avoid writing code that can be
exploited by attackers.


Download Secure Coding Principles & Practices by Mark G Graff,Kenneth,R Van Wyk

What Is Writing Source Code ?

PUBLISHED BY

Microsoft Press
A Division of Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052-6399
Copyright © 2002 by Microsoft Corporation
All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or
by any means without the written permission of the publisher.
Library of Congress Cataloging-in-Publication Data
Howard, Michael, 1965
Writing Secure Code / Michael Howard, David LeBlanc.
p. cm.
ISBN 0-7356-1588-8
1. Computer security. 2. Data encryption (Computer science) I. LeBlanc, David, 1960
II. Title.
QA76.9.A25 H698 2001
005.8--dc21 2001044546
Printed and bound in the United States of America.
1 2 3 4 5 6 7 8 9 QWE 6 5 4 3 2
Distributed in Canada by Penguin Books Canada Limited.
A CIP catalogue record for this book is available from the British Library.
Microsoft Press books are available through booksellers and distributors worldwide. For further
information about international editions, contact your local Microsoft Corporation office or contact
Microsoft Press International directly at fax (425) 706-7329. Visit our Web site at
www.microsoft.com/mspress. Send comments to mspinput@microsoft.com.
Active Directory, ActiveX, Authenticode, Hotmail, Jscript, Microsoft, Microsoft Press, MS-DOS,
MSDN, Visual Basic, Visual C++, Visual Studio, Win32, Windows, and Windows NT are either
registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
Other product and company names mentioned herein may be the trademarks of their respective owners.
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places,
and events depicted herein are fictitious. No association with any real company, organization, product,
domain name, e-mail address, logo, person, place, or event is intended or should be inferred.
Acquisitions Editor: Danielle Bird
Project Editor: Devon Musgrave
Technical Editor: Julie Xiao
Dedication
To Blake, God’s little gift to Cheryl and me. To Cheryl, Blake could not ask for a more wonderful mother.

— Michael

To Jennifer, for putting up with many lost weekends when we could have been out horseback riding. —
David
In memory of all those people who needlessly perished on September 11, 2001.

Foreword

Improving security was a major focus while we were developing Windows 2000. At one point, we
decided to run an unusual experiment to test the product’s mettle before we released it. We set up a
Windows 2000 Web server called “Windows2000test.com,” put it out there, and waited to see what
happened. We made no announcement of any kind; we didn’t call any attention to it in any way
whatsoever. Within a couple of hours, hundreds of people were already trying to hack it. Within days, tens
of thousands of people were hammering away.
These days, as soon as a product gets into their hands, hackers begin an intensive effort to find and exploit
security holes. If the product developers don’t make an equally intensive effort to build security into their
code, the hackers will almost surely succeed. A product’s security is every bit as important as its features.
Don’t get me wrong—people would have no reason to buy a product without great features. But while
developers know how to build features, they often don’t know how to design and build security. This
book changes that.
Writing Secure Code offers practical insights into secure design, secure coding, and testing techniques,
many of which are not documented elsewhere. It will give you a richer understanding of what it takes to
build secure applications. Michael and David are, respectively, members of the Secure Windows
Initiative and the Trustworthy Computing Security Team at Microsoft. They have witnessed firsthand the
sometimes basic coding mistakes that undermine product security, and their projects have helped us
significantly improve how we designed and implemented security in products such as Windows 2000 and
Windows XP. Their goal in writing this book is to pass on to you, the developer community, everything
Microsoft has learned.

Brian Valentine

Senior Vice President, Windows Division
Microsoft Corporation
Acknowledgments
When you look at the cover of this book, you see the names of only two authors, but this book would be
nothing if we didn’t get help and input from numerous people. We pestered some people until they were
sick of us, but still they were only too happy to help.
First, we’d like to thank the Microsoft Press folks, including Danielle Bird for agreeing to take on this
book, Devon Musgrave for turning “Geek” into English and managing not to complain too much, and Julie
Xiao for making sure we were not lying. Much thanks also to Elizabeth Hansford for laying out pages,
Rob Nance for the part opener art, and Shawn Peck for copyediting.
Many people answered questions to help make this book as accurate as possible, including the following
from Microsoft: Saji Abraham, Eli Allen, John Biccum, Scott Culp, Thomas Deml, Monica Ene-
Pietrosanu, Sean Finnegan, Tim Fleehart, Damian Haase, David Hubbard, Mike Lai, Louis Lafreniere,
Brian LaMacchia, John Lambert, Lawrence Landauer, Paul Leach, Terry Leeper, Steve Lipner, Rui
Maximo, Daryl Pecelj, Jon Pincus, Fritz Sands, Eric Schultze, Alex Stockton, Matt Thomlinson, Hank
Voight, Chris Walker, Richard Ward, Richard Waymire, Mark Zbikowski, and Mark Zhou.
We’d especially like to thank the following ’softies: Russ Wolfe, who explained numerous Unicode and
UTF-8 issues and wouldn’t shut up until we had the issues documented adequately. Kamen Moutafov, a
genuinely nice guy, who spent numerous hours helping with the RPC section. He’s one of those developers
who answers stupid questions without making you feel dumb. Erik Olsen went to great lengths to make
sure the .NET issues were nailed down. If it weren’t for Erik, Chapter 13 would be tiny. Eric Jarvi read
most all the chapters and helped immensely by offering numerous improvements, most of which started
with, “You really should explain…”
We want to point out that Kamen, Erik, and Eric rock. They diligently reviewed material while they were
in the final stages of shipping their respective products: Windows XP, the .NET Framework, and Visual
Studio .NET. It would have been easy for them to say, “I’m busy, leave me alone,” but they didn’t. They
could see that some short-term time spent getting this book right would have long-term benefits for
themselves (as they won’t have to answer the same questions time and again), for Microsoft, and, most
important, for our shared and valued customers.
Many outside Microsoft gave their time to help us with this book. We’d like to give our greatest thanks to
Rain Forest Puppy for providing first-rate Web security comments. By the way, Mr. Puppy, no offense
taken! John Pescatore of Gartner Inc. for his insightful (and blunt) comments, which helped shape the
early chapters. Professor Jesper Johansson of Boston University, who read every word, sentence,
paragraph, and chapter of the book and had comments on every word, sentence, paragraph, and chapter of
the book! Leslee LaFountain of the NSA for showing such great interest in this book. And, finally, the
Secure Windows Initiative team.


Download Writing Source Code by Micheal Howard

What is Data Structure ?

A data structure is a group of data elements grouped together under one name. These data elements, known as members, can have different types and different lengths. Data structures can be declared in C++ using the following syntax:

struct type_name {
member_type1 member_name1;
member_type2 member_name2;
member_type3 member_name3;
.
.
} object_names;

Where type_name is a name for the structure type, object_name can be a set of valid identifiers for objects that have the type of this structure. Within braces {}, there is a list with the data members, each one is specified with a type and a valid identifier as its name.

For example:

1
2
3
4
5
6
7
struct product {
  int weight;
  double price;
} ;

product apple;
product banana, melon;


This declares a structure type, called product, and defines it having two members: weight and price, each of a different fundamental type. This declaration creates a new type (product), which is then used to declare three objects (variables) of this type: apple, banana, and melon. Note how once product is declared, it is used just like any other type.

Right at the end of the struct definition, and before the ending semicolon (;), the optional field object_names can be used to directly declare objects of the structure type. For example, the structure objects apple, banana, and melon can be declared at the moment the data structure type is defined: 

1
2
3
4
struct product {
  int weight;
  double price;
} apple, banana, melon;


In this case, where object_names are specified, the type name (product) becomes optional: struct requires either a type_name or at least one name in object_names, but not necessarily both.

It is important to clearly differentiate between what is the structure type name (product), and what is an object of this type (apple, banana, and melon). Many objects (such as apple, banana, and melon) can be declared from a single structure type (product).

Once the three objects of a determined structure type are declared (apple, banana, and melon) its members can be accessed directly. The syntax for that is simply to insert a dot (.) between the object name and the member name. For example, we could operate with any of these elements as if they were standard variables of their respective types: 

1
2
3
4
5
6
apple.weight
apple.price
banana.weight
banana.price
melon.weight
melon.price


Each one of these has the data type corresponding to the member they refer to: apple.weight, banana.weight, and melon.weight are of type int, while apple.price, banana.price, and melon.price are of type double.

Here is a real example with structure types in action:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
// example about structures
#include <iostream>
#include <string>
#include <sstream>
using namespace std;

struct movies_t {
  string title;
  int year;
} mine, yours;

void printmovie (movies_t movie);

int main ()
{
  string mystr;

  mine.title = "2001 A Space Odyssey";
  mine.year = 1968;

  cout << "Enter title: ";
  getline (cin,yours.title);
  cout << "Enter year: ";
  getline (cin,mystr);
  stringstream(mystr) >> yours.year;

  cout << "My favorite movie is:\n ";
  printmovie (mine);
  cout << "And yours is:\n ";
  printmovie (yours);
  return 0;
}

void printmovie (movies_t movie)
{
  cout << movie.title;
  cout << " (" << movie.year << ")\n";
}
Enter title: Alien
Enter year: 1979

My favorite movie is:
 2001 A Space Odyssey (1968)
And yours is:
 Alien (1979)
Edit & Run


The example shows how the members of an object act just as regular variables. For example, the member yours.year is a valid variable of type int, and mine.title is a valid variable of type string.

But the objects mine and yours are also variables with a type (of type movies_t). For example, both have been passed to function printmovie just as if they were simple variables. Therefore, one of the features of data structures is the ability to refer to both their members individually or to the entire structure as a whole. In both cases using the same identifier: the name of the structure.

Because structures are types, they can also be used as the type of arrays to construct tables or databases of them:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
// array of structures
#include <iostream>
#include <string>
#include <sstream>
using namespace std;

struct movies_t {
  string title;
  int year;
} films [3];

void printmovie (movies_t movie);

int main ()
{
  string mystr;
  int n;

  for (n=0; n<3; n++)
  {
    cout << "Enter title: ";
    getline (cin,films[n].title);
    cout << "Enter year: ";
    getline (cin,mystr);
    stringstream(mystr) >> films[n].year;
  }

  cout << "\nYou have entered these movies:\n";
  for (n=0; n<3; n++)
    printmovie (films[n]);
  return 0;
}

void printmovie (movies_t movie)
{
  cout << movie.title;
  cout << " (" << movie.year << ")\n";
}
Enter title: Blade Runner
Enter year: 1982
Enter title: The Matrix
Enter year: 1999
Enter title: Taxi Driver
Enter year: 1976

You have entered these movies:
Blade Runner (1982)
The Matrix (1999)
Taxi Driver (1976)
Edit & Run


Pointers to structures
Like any other type, structures can be pointed to by its own type of pointers:

1
2
3
4
5
6
7
struct movies_t {
  string title;
  int year;
};

movies_t amovie;
movies_t * pmovie;


Here amovie is an object of structure type movies_t, and pmovie is a pointer to point to objects of structure type movies_t. Therefore, the following code would also be valid:


pmovie = &amovie;


The value of the pointer pmovie would be assigned the address of object amovie.

Now, let's see another example that mixes pointers and structures, and will serve to introduce a new operator: the arrow operator (->):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
// pointers to structures
#include <iostream>
#include <string>
#include <sstream>
using namespace std;

struct movies_t {
  string title;
  int year;
};

int main ()
{
  string mystr;

  movies_t amovie;
  movies_t * pmovie;
  pmovie = &amovie;

  cout << "Enter title: ";
  getline (cin, pmovie->title);
  cout << "Enter year: ";
  getline (cin, mystr);
  (stringstream) mystr >> pmovie->year;

  cout << "\nYou have entered:\n";
  cout << pmovie->title;
  cout << " (" << pmovie->year << ")\n";

  return 0;
}
Enter title: Invasion of the body snatchers
Enter year: 1978

You have entered:
Invasion of the body snatchers (1978)
Edit & Run


The arrow operator (->) is a dereference operator that is used exclusively with pointers to objects that have members. This operator serves to access the member of an object directly from its address. For example, in the example above:


pmovie->title


is, for all purposes, equivalent to: 


(*pmovie).title


Both expressions, pmovie->title and (*pmovie).title are valid, and both access the member title of the data structure pointed by a pointer called pmovie. It is definitely something different than:


*pmovie.title


which is rather equivalent to:


*(pmovie.title)


This would access the value pointed by a hypothetical pointer member called title of the structure object pmovie (which is not the case, since title is not a pointer type). The following panel summarizes possible combinations of the operators for pointers and for structure members:

Expression What is evaluated Equivalent
a.b Member b of object a
a->b Member b of object pointed to by a (*a).b
*a.b Value pointed to by member b of object a *(a.b)

Nesting structures
Structures can also be nested in such a way that an element of a structure is itself another structure:

1
2
3
4
5
6
7
8
9
10
11
12
struct movies_t {
  string title;
  int year;
};

struct friends_t {
  string name;
  string email;
  movies_t favorite_movie;
} charlie, maria;

friends_t * pfriends = &charlie;


After the previous declarations, all of the following expressions would be valid:

1
2
3
4
charlie.name
maria.favorite_movie.title
charlie.favorite_movie.year
pfriends->favorite_movie.year


(where, by the way, the last two expressions refer to the same member).
Download Data Structure Programmes

Definition - What does C++ Programming Language mean?

C++ is a general-purpose object-oriented programming (OOP) language, developed by Bjarne Stroustrup, and is an extension of the C language. It is therefore possible to code C++ in a "C style" or "object-oriented style." In certain scenarios, it can be coded in either way and is thus an effective example of a hybrid language.

C++ is considered to be an intermediate-level language, as it encapsulates both high- and low-level language features. Initially, the language was called "C with classes" as it had all the properties of the C language with an additional concept of "classes." However, it was renamed C++ in 1983.

It is pronounced "see-plus-plus."

C++ is a middle-level programming language developed by Bjarne Stroustrup starting in 1979 at Bell Labs. C++ runs on a variety of platforms, such as Windows, Mac OS, and the various versions of UNIX.

This reference will take you through simple and practical approach while learning C++ Programming language.

Audience
This reference has been prepared for the beginners to help them understand the basic to advanced concepts related to C++ Programming languages.

Prerequisites
Before you start doing practice with various types of examples given in this reference, I'm making an assumption that you are already aware about what is a computer program and what is a computer programming language?

Execute C++ Online
For most of the examples given in this tutorial you will find Try it option, so just make use of this option to execute your C++ programs at the spot and enjoy your learning.

Try following example using Try it option available at the top right corner of the below sample code box −

#include <iostream>
using namespace std;

int main() {
   cout << "Hello World";
   return 0;
}

Download C++ Programmes