Book Description
Information Technology Control and Audit, Second Edition is an excellent introductory textbook for IT auditing. It covers a wide range of topics in the field including the audit process, the legal environment of IT auditing, security and privacy, and much more. This textbook first examines the foundation of IT audit and control, discussing what IT auditing involves and the guidance provided by organizations in dealing with control and auditability issues. It then analyzes the process of audit and review, explores IT governance and control, and discusses the CobiT framework and steps that align IT decisions with business strategy. This volume examines project management processes that ensure that projects are controlled from inception through integration. It continues by addressing auditing IT acquisition and implementation, describing risks and controls as related to the life cycle of application systems. It highlights the purchase and installation of new systems, as well as change management. The next section examines the auditing of IT operations in both standalone and global environments, covering types of IT operation, issues related to specific platforms, risk and control assessment, and audit methods and support tools. The textbook concludes with a review of emerging issues, providing undergraduate and graduate students with a thorough overview of a topic critical to organizational security and integrity.
Customer Reviews:
Not good for the CISA exam.......2007-10-02
I bought this book as an additional material to study for the CISA exam. However it didn't help me with the exam at all. Furthermore, in an attempt to cover many things, it did not cover anything in detail. This book is just an endless recollection of bullet points. On top of that, it misses very sensitive topics like disaster recovery planning.
Useful reference material.......2007-02-02
This book has some material relevant to the CISA examination based on the 2003 content areas, although it is not organized or focused as a CISA examination guide. If you are looking for CISA review material for the test, I would strongly suggest to stick with ISACA's combination of review manual and questions CD. I also searched everywhere for study aids for this grueling test and ended up using ISACA's expensive material, but it proved to be the best choice as I passed the Dec 2006 test.
However, as owner of a copy of this book, I assure you that this is an excellent reference of IT management, planning, implementation, risk assessment and control procedures for anyone in the IT business. Most of the material is still relevant as of 2007.
Finally a usable explanation of controls!.......2006-12-30
Audit is not the most exciting topic in the world, but this no fluff book really sets the standard. The care the authors took is obvious from the start, the table of contents is one of the most detailed I have ever seen, it allows the book to be used as a reference.
My favorite chapter was Quality Management, best job of making quality approachable I have seen to date. My least favorite was Project Management, it seemed to lack the application and lean to theory a bit.
I am not an auditor, but as an auditee, this book really helped me understand how they think. Recommended!
Too thin.......2006-03-24
This is a huge book but spends no more then 1 page on any topic. In my opinion the authors only have financial audit experience and little understanding of IT controls. This book shows the failure of the 'integrated auditor' as the authors are tyring to be IT auditors with little IT experience. They touch on some very good points in a few instances and, in general, the book is decent. The authors do not know much outside of the CISA, IIA and financial based certifications as they seem to think that the ISSA (Information Systems Security Assoc.) is sponsored by ISC2/CISSP's (it is not). Overall, I have not been impressed with this book.
Great resource.......2005-12-13
Not having much experience in the IT audit field, this book was a great resource and was easy to understand.
Book Description
The Security Risk Assessment Handbook: A Complete Guide for Performing Security Risk Assessments provides detailed insight into precisely how to conduct an information security risk assessment. Designed for security professionals and their customers who want a more in-depth understanding of the risk assessment process, this volume contains real-world advice that promotes professional development. It also enables security consumers to better negotiate the scope and rigor of a security assessment, effectively interface with a security assessment team, deliver insightful comments on a draft report, and have a greater understanding of final report recommendations. This book can save time and money by eliminating guesswork as to what assessment steps to perform, and how to perform them. In addition, the book offers charts, checklists, examples, and templates that speed up data gathering, analysis, and document development. By improving the efficiency of the assessment process, security consultants can deliver a higher-quality service with a larger profit margin. The text allows consumers to intelligently solicit and review proposals, positioning them to request affordable security risk assessments from quality vendors that meet the needs of their organizations.
Customer Reviews:
RIIOT in the Streets we have a standard!!!!.......2006-05-30
Finally Some one has heard our struggle!! We have a guide that is easily read and solves the blank sheet of paper problem. The book is based in a real world and shows almost step by step the process. The major selling point to me is it serves as a great reference book as well. When you need collection points or industry standards this is the book. Read it and you will not leave for a risk assessment with out it.
The first book to read!.......2006-05-30
Very easy to read. Very good details on how the security industry works, no more secrets.
Book Description
Never before have there been so many laws designed to keep corporations honest. New laws and regulations force companies to develop stronger ethics policies and the shareholders themselves are holding publicly traded companies accountable for their practices. Consumers are also concerned over the privacy of their personal information and current and emerging legislation is reflecting this trend. Under these conditions, it can be difficult to know where to turn for reliable, applicable advice. The sixth edition of the Information Security Management Handbook addresses up-to-date issues in this increasingly important area. It balances contemporary articles with relevant articles from past editions to bring you a well grounded view of the subject. The contributions cover questions important to those tasked with securing information assets including the appropriate deployment of valuable resources as well as dealing with legal compliance, investigations, and ethics. Promoting the view that the management ethics and values of an organization leads directly to its information security program and the technical, physical, and administrative controls to be implemented, the book explores topics such as risk assessments; metrics; security governance, architecture, and design; emerging threats; standards; and business continuity and disaster recovery. The text also discusses physical security including access control and cryptography, and a plethora of technology issues such as application controls, network security, virus controls, and hacking. US federal and state legislators continue to make certain that information security is a board-level conversation and the Information Security Management Handbook, Sixth Edition continues to ensure that there you have a clear understanding of the rules and regulations and an effective method for their implementation.
Customer Reviews:
Excellent Security book.......2007-01-05
Excellent very extensive security book. A very good reminder for the preparation of the CISSP exam. (is one of the official recommended books).
I passed my CISSP exam, because of this book.
Jako Boonekamp
CISSP #97956
The Netherlands
A multiple vision of IT Security.......2006-03-23
This book is an excellent example of compilation of dozens of good works on IT Security. The quality of articles and the different points of view whereupon are treated turn to it an essential work. It only has a failure: such amount of information has been packed in only a volume that has forced the publisher to reduce both the font and the thickness of the paper to the maximum. Very bad for that no longer we have twenty years and in addition we were used to mark the most interesting paragraphs with a pencil.
Book content is excellent, but paper quality is worst ever.......2005-12-16
I am reading the fifth edition of this book. In the earlier editions the book was published in three or four volumes. The fifth edition is a combination of all volumes. So that is good.
The book is a dense read. But the content is excellent. There are 163 chapters in this book. Each chapter written by different authors - experts in respective areas. So the book provides a best of breed treatment to various assorted topics. However, not all chapters are good (but most are). I'd say about 20 or so are of filler kind of chapters. Nothing really special in them. But the book is worth for the rest of the matter.
The chapters are also written to provoke further thought into each area. Kind of "first principles" approach - which I like compared to the CISSP guide approach of "here is the information, now devour it for the exam". However this book is not an exam guide (and I knew that before hand). I bought this book for the matter in it and I am very satisfied.
If you are the kind of person who want to quickly assimilate and regurgitate the matter for CISSP, then dont even bother. I am kind of person who loves to read things from the basics slowly, getting the concepts and ideas all clear in my mind and hence I plan to finish this book before reading CISSP exam guide (which by the way is also sitting on my bookshelf).
However I have a major complaint againg the publishers. Having charged One hundred thirty dollars for a 2000 page book, I'd expect the quality of paper is decent. The paper is so thin, I invariably turn two pages when I am thiking it is one page. It is so thin, even turning the page carefully damages the paper. I agree that the content is specialized and most authors hold at least two or more certifications (CISSP, CISA, SSCP etc.), but that does not warrant printing the book on really wafer thin transparent paper. Sure, the publishers need to make money, but not by compromising the quality of the paper SO MUCH.
And you'd expect this kind of book to live on your shelf for a long long time than "Teach yourself crap in 24 hours" books, but the quality of paper will make that unlikely. Hence I am giving 4 stars to a book which otherwise would deserve 6 stars
Volumes vs editions.......2005-04-19
Some of the reviewers are confusing 'volumes' with editions. Each edition of this book contains several volumes. Each volume contains new papers, adding them to the current edition of the ISMH.
The current edition of the Information Security Management Handbook is the 5th. At present, it has only 2 volumes. This CD-ROM only contains the 1st volume of the 5th edition. There is a new CD-ROM of the ISMH with a 2005 date (ISBN 0849339422) which I *think* contains the new volume 2 of the 5th edition (ISBN 0849332109)
What makes this CD-ROM valuable over the 5thED-V1 book is that it contains the contents of the 3rd and the 4th editions! I know the 4th edition contained four volumes.
Excellent reference!.......2003-09-04
Excellent reference!
This is an excellent security reference!
If you are looking for a pure CISSP prep book, this is not the best. But for general info sec, this is an awesome book.
Book Description
"This book is a must-read for architects, landlords, security consultants and anyone else tasked with or interested in ensuring security and averting catastrophic loss." -- Bernard B. Kerik, 40th Police Commissioner, New York City (Ret.)
Whether planning for new construction, renovations, or security upgrades of existing facilities, Building Security: Handbook for Architectural Planning and Design is the definitive twenty-first century reference on security design, technology, building operations, and disaster planning.
Award-winning architect and author Barbara A. Nadel, FAIA, and over 50 national experts provide security design solutions for creating safe commercial, institutional, industrial, and residential buildings in the post-September 11, 2001, environment. Generously illustrated with 600 photos, drawings, tables, and checklists.
Customer Reviews:
Building Security: Handbook for Architectural Planning and Design.......2006-06-09
Barbara A. Nadel. FAIA creates the resource for architects for security design. Nadel empasizes owners assembling a security team at the beginning of a project when design professionals can plan for and budget good security strategies. Most of the text is very informative and uses examples as well as compiles articles developed by security consultants in the field. In this unparalleled book Barbara A. Nadel, FAIA creates the source for security design. A must have resource for all architects, planners, landscape designers, lighting consultants and engineers in a security conscious design era; post 9/11.
Security in a New Light.......2006-05-23
Since 9/11, the security industry has been evolving. The need for standards in the industry is imperative and this book discusses a varity of industries and their standards of care. This book is a great reference for anyone in any industry that is looking for information on security. Building Security: Handbook for Architectural Planning and Design is a must have.
The Final Word on Building Security.......2006-04-16
Nadel's Building Security: Handbook for Architectural Planning and Design is the final word on the creation a safe built environment. From broad case study analysis (Oklahoma City) to engineering details and protocol checklists, this tome provides owners, the entire design team and safety officials all the information they need to secure a structure and plan for responses to incidents. Building Security is simply the best work on the subject out there and I highly recommend it.
Attorney at law.......2004-11-28
I'll never look at my clients' nursing home facilities the same as I did before I read this handbook! I'm a healthcare attorney, not an architect. There are some chapters that are more applicable to my role with clients than others; nevertheless, I found this book extremely informative and thought provoking. Clearly this book was a labor of love for Ms. Nadel.
The Zen of Security: A must have.......2004-07-06
Security from soup to nuts, here it is, in one big book. Big picture ideas, nitty gritty details, many different security concepts. Lots of tips and checklists on how anyone can apply them in any scenario or location. Packed with all kinds of useful information for designers, building owners, security personnel, students, professors, and just plain folks. Well-organized and edited, beautifully illustrated, very user-friendly. Simply a remarkable volume about one of the most important subjects on the planet.
Destined to become the bible for security experts - or those who wish they were!
Average customer rating:
- A Must Book for IT Auditors
- This is a Great Book!
- Review of HP Nonstop Server Security
|
HP NonStop Server Security: A Practical Handbook (HP Technologies)
XYPRO Technology Corp
Manufacturer: Digital Press
ProductGroup: Book
Binding: Paperback
 Client-Server Systems
| Data in the Enterprise
| Networking
| Computers & Internet
| Subjects
| Books
Network Security
| Networking
| Computers & Internet
| Subjects
| Books
General
| Operating Systems
| Computers & Internet
| Subjects
| Books
General
| Hardware
| Computers & Internet
| Subjects
| Books
Look Inside Computer Books
| Trip
| Specialty Stores
| Books
All Amazon Upgrade
| Amazon Upgrade
| Stores
| Books
Computers & Internet
| Amazon Upgrade
| Stores
| Books
All Titles
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Computers & Internet
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Similar Items:
-
Securing HP NonStop Servers in an Open Systems World: TCP/IP, OSS and SQL
-
NonStop Kernel System Administration
ASIN: 1555583148 |
Book Description
Since the last publication of the Ernst and Young book on Tandem security in the early 90's, there has been no such book on the subject. We've taken on the task of supplying a new Handbook whose content provides current, generic information about securing HP NonStop servers. Emphasis is placed on explaining security risks and best practices relevant to NonStop environments, and how to deploy native security tools (Guardian and Safeguard). All third party vendors who supply security solutions relevant to NonStop servers are listed, along with contact information for each vendor. The Handbook is a source for critical information to NonStop professionals and NonStop security administrators in particular. However, it is written in such a way as to also be extremely useful to readers new to the NonStop platform and to information security.
This handbook familiarizes auditors and those responsible for security configuration and monitoring with the aspects of the HP NonStop server operating system that make the NonStop Server unique, the security risks these aspects create, and the best ways to mitigate these risks.
· Addresses the lack of security standards for the NonStop server
· Provides information robust enough to train more security-knowledgeable staff
· The ideal accompaniment to any new HP NonStop system
Customer Reviews:
A Must Book for IT Auditors.......2007-09-05
Excellent book for IT auditors and security staff. Presents SafeGuard and Guardian settings and parameters. Also provides format of significant commands to enter in order to obtain informatin from the system. Risks and recommended settings are included for all areas. Book provides more audit information than regular HP Tandem technical manuals with tons of usefull information. Over 600 pages of Tandem security, audit and control details. The only weakness may be that much of the related information is in different places. In otherwords, an item is mentioned in chapter one but more details are provided in chapter 4. But once you understand the structure of the book, its easier to find the materials. Also, as a suggestion, it should list in generalities areas to audit in order of sigificance. This would help the reader to prioritise areas and audit tasks.
This is a Great Book!.......2004-03-20
Tandem security people have been waiting for years for a helpful tool such as this to guide us through the important aspects of our job.
I highly recommend it and found the depth of information to be very impressive.
Review of HP Nonstop Server Security.......2004-02-18
The book is not accurate in MANY of its suggestions.
e.g. it claims, that a NSK user NEEDS to run a $CMON process to gain a maximum of security, which for sure is misleading the reader.
The requirements to the C compiler for using PATHMAKER is totally incorrect.
And this goes on-and-on-and-on.
It is NOT worth the money!
Book Description
This book identifies the key knowledge, skills and abilities required for success in the assessment center promotional process. Assessment centers are widely used by fire departments throughout the country. Unfortunately, many candidates fail to prepare for the test by failing to prepare for the position they seek. Whether aspiring to be a Lieutenant, Captain, Battalion Chief or above, this book gives the reader the tools to establish a personal plan for success in the test and in the position.
This book is written in a humorous, matter-of-fact style that makes it easy to understand and retain. The reader is taught to truly prepare for the position and make the mental paradigm shift from test candidate to incumbent officer, which is a very unique and effective method.
The book provides the reader with the tools needed to create his/her own plan for success. A personal self-assessment helps the aspiring officer evaluate his/her current status and leadership style. This baseline provides the foundation to get the reader asking questions about real-world scenarios that are mimicked in the testing arena.
Features & benefits:
* Gain a better understanding of what an assessment center is
* Contains test exercises, sample problems, rating criteria, scoring sheets, assessor selection and common pitfalls
*Learn the 27 knowledge, skills, and abilities (KSA's) spanning the 3 dimensions of leadership, management and emergency scene operations
*Gain an in-depth understanding of how to develop their KSAs to succeed in the test and the position
Customer Reviews:
A GREAT ASSET TO FIRE LIBRARY.......2007-03-30
THIS BOOK HELPED ME WITH SOME KEY POINTS IN MY ASSESSEMENT FOR FIRE CAPTAIN. THE LITTLE THINGS THAT MOST PEOPLE DON'T THINK ABOUT, ARE ASSESSED AT YOUR INTERVIEW.. THIS BOOK IS A WINNER IN MY BOOK >LA CITY
Mastering the Fire Service Assessment Center.......2007-03-16
This is a well laid out and easy to read preperatory manual for assessment centers. And, it worked!
excellent modern-day test guide.......2007-02-01
If you are in the testing process for any level of supervision, this is an excellent resource to add to your pool of "advice". Take it, and use it as a guidebook. Add to it, delete parts that dont work, and make it work for you.
Average customer rating:
|
Terrorism Handbook for Operational Responders, 2e
Armando S. Bevelacqua
Manufacturer: Cengage Delmar Learning
ProductGroup: Book
Binding: Paperback
General
| Military
| History
| Subjects
| Books
Civil Rights & Liberties
| Current Events
| Nonfiction
| Subjects
| Books
Terrorism
| Current Events
| Nonfiction
| Subjects
| Books
General
| Political Science
| Social Sciences
| Nonfiction
| Subjects
| Books
Law Enforcement
| Criminal Law
| Law
| Subjects
| Books
Manufacturing
| Industrial, Manufacturing & Operational Systems
| Engineering
| Professional & Technical
| Subjects
| Books
Law Enforcement
| Criminal Law
| Law
| Professional & Technical
| Subjects
| Books
Emergency Medical Services
| Allied Health Professions
| Medical
| Professional & Technical
| Subjects
| Books
Firefighting & Prevention
| Civil Service
| Professional & Technical
| Subjects
| Books
General
| Science
| Subjects
| Books
Emergency Medical Services
| Allied Health Professions
| Medicine
| Subjects
| Books
Look Inside Nonfiction Books
| Trip
| Specialty Stores
| Books
Look Inside Science Books
| Trip
| Specialty Stores
| Books
All Titles
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Medicine
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Nonfiction
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Professional
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Science
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Similar Items:
-
America's Achilles' Heel: Nuclear, Biological, and Chemical Terrorism and Covert Attack (BCSIA Studies in International Security)
-
Emergency Response Planning for Corporate and Municipal Managers, Second Edition (Butterworth-Heinemann Homeland Security)
-
Bombs, Bugs, Drugs, and Thugs: Intelligence and America's Quest for Security
-
The New Face of Terrorism: Threats from Weapons of Mass Destruction
-
Fear Less: Real Truth About Risk, Safety, and Security in a Time of Terrorism
ASIN: 1401850650 |
Book Description
The only reference of its kind for emergency responders, this updated book is a guide to the most significant points that surround the emergency response processes needed to cope with terrorism incidents. It highlights what is required to establish and implement tactical goals during such events, including new equipment and strategies that can enhance a responder's detection, monitoring, and protection capabilities against chemical and biological agents. Written to provide emergency responders with the knowledge they need to prepare for and combat acts of terrorism, this book is a must for all emergency personnel who are called on to respond to a terrorist event.
Average customer rating:
- some useful advice
- Highlighting
- A book which should be read by all first responders...
|
The Counterterrorism Handbook: Tactics, Procedures, and Techniques, Second Edition
Jr., Frank Bolz ,
Kenneth J. Dudonis , and
David P. Schulz
Manufacturer: CRC
ProductGroup: Book
Binding: Hardcover
Social Services & Welfare
| Poverty
| Current Events
| Nonfiction
| Subjects
| Books
Terrorism
| Current Events
| Nonfiction
| Subjects
| Books
Criminology
| Crime & Criminals
| Nonfiction
| Subjects
| Books
Forensic Science
| Crime & Criminals
| Nonfiction
| Subjects
| Books
General
| Law
| Subjects
| Books
Law Enforcement
| Criminal Law
| Law
| Subjects
| Books
Reference
| Engineering
| Professional & Technical
| Subjects
| Books
Law Enforcement
| Criminal Law
| Law
| Professional & Technical
| Subjects
| Books
General
| Law
| Professional & Technical
| Subjects
| Books
General
| Science
| Subjects
| Books
Engineering
| Reference
| Science
| Subjects
| Books
All Titles
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Nonfiction
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Professional
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Science
| Qualifying Textbooks - Fall 2007
| Stores
| Books
Similar Items:
-
Origins of Terrorism: Psychologies, Ideologies, Theologies, States of Mind (Woodrow Wilson Center Press)
-
Terrorism in the 21st Century (4th Edition)
-
Explosives Identification Guide
-
21st Century Complete Guide to Bioterrorism, Biological and Chemical Weapons, Germs and Germ Warfare, Nuclear and Radiation Terrorism - Military Manuals ... Medical Treatment and Survival Information
-
Raids: A Tactical Guide to High Risk Warrant Service
ASIN: 0849309646 |
Book Description
The Counterterrorism Handbook, Second Edition guides law enforcement as well as industrial and private security personnel through a terrorism situation or potential threat, including bomb threats, hostage situations, kidnapping, and negotiation. The authors group the material by chronological sequence: pre-incident, including planning and preparation; incident, concerning terrorist situations as they unfold; and post-incident, including the ranking officers' roles in supervising police response. New topics include international terrorism, cults, the effects of the new millennium, and analyses of events such as the Oklahoma City bombing and Waco.
Customer Reviews:
some useful advice.......2006-10-01
The book came out in 2002 and was certainly written before the events of September 2001. Certainly seems germane nowadays. It tries to systematically study terrorism. Its causes and its tactics. Needless to say, when I turn to the index and look up hijacking, none of the book's instances refer to the possibility of kamikazes. This is how we can tell that it was written before September 2001.
The book is mostly concerned with counterterrorism methods, of course. Much of this very relevant. Practical advice that can be taken regardless of the ideologies of the terrorists. There are no real surprises here in terms of techniques. Though the book does have some insightful anecdotes about actual events.
Highlighting.......2005-11-14
I looked inside the book and there is aliitle bit of highlighting where info was found to be of some importance.
A book which should be read by all first responders..........2002-02-10
This book gives you the vital information you need to perform your duties as a first responder as well as showing security and safety managers what is expected of them also. The information is given in bite size chunks so as to aid in the retention of the material. The pictures and tables are very helpful in getting the key ideas across. The case studies of both the Oklahoma and first WTC attack are noteworthy for their detail. If you are responsible for the safety of persons or a first responder this is one book you should read and take to heart.
Average customer rating:
- Overpriced
- Alright - not very meaty though
- PHP Security is a HUGE topic
- VERY VERY HIGHLY RECOMMENDED!!
- Essential for the Beginner or Advanced PHP developer
|
Essential PHP Security
Chris Shiflett
Manufacturer: O'Reilly Media, Inc.
ProductGroup: Book
Binding: Paperback
Encryption
| Security & Encryption
| Web Development
| Computers & Internet
| Subjects
| Books
PHP
| Programming
| Web Development
| Computers & Internet
| Subjects
| Books
General
| Programming
| Web Development
| Computers & Internet
| Subjects
| Books
Privacy
| Business & Culture
| Computers & Internet
| Subjects
| Books
Hacking
| Business & Culture
| Computers & Internet
| Subjects
| Books
Security
| Business & Culture
| Computers & Internet
| Subjects
| Books
Network Security
| Networking
| Computers & Internet
| Subjects
| Books
General
| Programming
| Computers & Internet
| Subjects
| Books
MySQL & mSQL
| Specific Databases
| Databases
| Computers & Internet
| Subjects
| Books
General
| Computers & Internet
| Subjects
| Books
Web Programming
| Programming
| O'Reilly
| By Publisher
| Books
General
| Programming
| O'Reilly
| By Publisher
| Books
Web Authoring & Design
| Web Development
| O'Reilly
| By Publisher
| Books
Internet Security
| O'Reilly
| By Publisher
| Books
Similar Items:
-
PHP Hacks: Tips & Tools For Creating Dynamic Websites (Hacks)
-
Pro PHP Security
-
php|architect's Guide to PHP Security|
-
PHP 5 Objects, Patterns, and Practice
-
PHP Cookbook (Cookbooks (O'Reilly))
ASIN: 059600656X |
Book Description
Being highly flexible in building dynamic, database-driven web applications makes the PHP programming language one of the most popular web development tools in use today. It also works beautifully with other open source tools, such as the MySQL database and the Apache web server. However, as more web sites are developed in PHP, they become targets for malicious attackers, and developers need to prepare for the attacks.
Security is an issue that demands attention, given the growing frequency of attacks on web sites. Essential PHP Security explains the most common types of attacks and how to write code that isn't susceptible to them. By examining specific attacks and the techniques used to protect against them, you will have a deeper understanding and appreciation of the safeguards you are about to learn in this book.
In the much-needed (and highly-requested) Essential PHP Security, each chapter covers an aspect of a web application (such as form processing, database programming, session management, and authentication). Chapters describe potential attacks with examples and then explain techniques to help you prevent those attacks.
Topics covered include:
- Preventing cross-site scripting (XSS) vulnerabilities
- Protecting against SQL injection attacks
- Complicating session hijacking attempts
You are in good hands with author Chris Shiflett, an internationally-recognized expert in the field of PHP security. Shiflett is also the founder and President of Brain Bulb, a PHP consultancy that offers a variety of services to clients around the world.
Customer Reviews:
Overpriced.......2007-01-03
Of the 103 pages in the book there are probably only 13 of unique information and 90 pages of saying the same exact thing over and over again. Worse yet, I found the author had already released the 13 pages of useful information online for free.
Definitely wish I had browsed this one in a store before I blew $30.
Alright - not very meaty though.......2006-12-26
Alright - not very meaty. Overall I'm glad I read it though, as I picked up some useful nuggets.
==========
Update 2006-12-30 - I'd like to bump this up to four stars. The book came in handy today - I used some code in it regarding session variables.
PHP Security is a HUGE topic.......2006-09-27
This book is essential for anyone starting out in PHP, but not only for them. It offers tips for almost any skill level, maybe you know some of the ways to keep your site secure but Chris really goes in depth on some of them.
The code snippets are short, simple, but convey the point exactly as intended... and I also like Chris's method for validating tainted data, similar to a fisherman. If the fish is bad throw it back and the same goes for user input.
I still have this book for reference and have lent it to a few people which resulted in them picking their own copies... all around a great resource.
VERY VERY HIGHLY RECOMMENDED!!.......2006-06-12
Are you a developer who is writing insecure PHP code? If you are, then this book is for you! Author Chris Shiflett, has done an outstanding job of writing a practical book that will help you improve your PHP application-level security.
Shiflett, begins by giving an overview of security principles and best practices. Then, the author covers form processing and attacks such as cross-site scripting and cross-site request forgeries. He continues by focusing on using databases and attacks such as SQL injection. Then, the author explains PHP's session support and shows you how to protect your applications from attacks such as session fixation and session hijacking. Then, he covers the risks associated with the use of includes, such as backdoor URLs and code injection. Next, the author discusses attacks such as filesystem traversal and command injection. Then, he shows you how to create secure authentication and authorization mechanisms and how to protect your applications from things like brute force attacks and replay attacks. Finally, the author explains the inherent risks associated with a shared hosting environment.
This most excellent book brings long-needed security guidelines to PHP developers everywhere. More importantly, the content of this book will be an asset to your development teams.
Essential for the Beginner or Advanced PHP developer.......2006-04-11
As a very security conscious developer, I found this book to be a GREAT resource to my library. Though the book is short in length, it is very rich in content. Chris does a GREAT job of presenting the problem (citing specific examples of the exploits), showing the pitfalls, and then presenting the solutions.
He is very thorough in his descriptions, and his easy to understand writing and use of analogies made this a very simple concept to grasp. If you are a seasoned PHP developer, or just beginning programming PHP - his writing style helps you to understand the underlying attack, visuals to see it in action, and how to prevent being attacked - it is very simple, yet deep.
Reading this book has helped me to see where my applications may fall short, and what I can do to protect them. Especially in the realm of PHP developers, there are MANY Open Source options out there, and many of them lack the security that is mentioned in the chapters of this book. Don't let yourself get caught!
I recommend this book, and performing an audit of your own work. Excellent book!
Customer Reviews:
Every Coastie should read this everyday!.......2007-09-04
Great book, read it everyday. Us Coasties sometimes forget the basics. Read it well and read it often.
Worth it's weight in gold!.......2007-01-12
I took this book and showed it to my recruiter and he said that it's weight in gold, and that after I was done reading it I woul be ahead of everybody else.
A well teaching book for the coast guard.......2004-08-25
It teaches about ROTC and the uniforms during your hopefull coast guard career. It also teaches all the necessary tools you need to be in the coast guard.
Great book for all.......2001-06-16
I am in the Coast Guard myself and when I was in boot camp they even handed out copies of this book to us to learn what we needed to know about the USCG. It covers everything from a brief history to customs and courtesies and to Maritime Law Enforcement. It talks about the different knots we use and how to properly tie the knot. There's history on the USCG's uniforms and the different ships we use to the different jobs that we offer. It's a great book for all and I even find myself at times referring to it whenever I need to know something! So I recommend it for anyone who is entering the Coast Guard, looking to up their seamanship skills or just want a refresher!
Still Excellant.......2000-08-22
I was issued one of these in boot camp back in 79. As a American Legion Commander now, I needed to know how to properly handle a weapon while marching and doing drills. Darn I wish I had of keep it. But I ordered the latest edition and see it is still the great manual it always was and still has the commands and the examples of how to do proper manual of arms.
Books:
- Interest Rate Models - Theory and Practice: With Smile, Inflation and Credit (Springer Finance)
- Interest Rate Models - Theory and Practice: With Smile, Inflation and Credit (Springer Finance)
- Interest Rate Models - Theory and Practice: With Smile, Inflation and Credit (Springer Finance)
- International Business: A Managerial Perspective (4th Edition)
- International Political Economy: Interests and Institutions in the Global Economy (2nd Edition)
- Land Development Handbook (Handbook)
- Macromedia Dreamweaver 8 Hands-On Training
- Modeling Risk: Applying Monte Carlo Simulation, Real Options Analysis, Forecasting, and Optimization Techniques (Wiley Finance)
- Money, Banking, and Financial Markets
- Move Your Stuff, Change Your Life : How to Use Feng Shui to Get Love, Money, Respect and Happiness
Books Index
Books Home
Recommended Books
- Code Talker: A Novel About the Navajo Marines of World War Two
- Why Do I Think I Am Nothing Without a Man
- Source Book of Medical History
- Student Study Guide to accompany Anatomy and Physiology: The Unity of Form and Function
- The PowerScore LSAT Logic Games Bible
- Wooden
- The Water Room
- Infiltrate: The Front Lines of the NYC Design Scene
- The Penguin Dictionary of Architecture and Landscape Architecture: Fifth Edition
- The Silver Anniversary Murder: A Christine Bennett Mystery
Core Concepts of Information Technology Auditing
CISA: Certified Information Systems Auditor Study Guide
CISA Exam Cram 2 : Certified Information Systems Auditor
Sarbanes-Oxley IT Compliance Using COBIT and Open Source Tools
IT Auditing: Using Controls to Protect Information Assets
