The Cert C Secure Coding Standard( Series - Sei Series In Software Engineering )

"I'm an enthusiastic supporter of the CERT Secure Coding Initiative. Programmers have lots of sources of advice on correctness, clarity, maintainability, performance, and even safety. Advice on how specific language features affect security has been missing. "The CERT C Secure Coding Standard "fills this need."
-Randy Meyers, Chairman of ANSI C
"For years we have relied upon the CERT/CC to publish advisories documenting an endless stream of security problems. Now CERT has embodied the advice of leading technical experts to give programmers and managers the practical guidance needed to avoid those problems in new applications and to help secure legacy systems. Well done "
-Dr. Thomas Plum, founder of Plum Hall, Inc.
"Connectivity has sharply increased the need for secure, hacker-safe applications. By combining this CERT standard with other safety guidelines, customers gain all-round protection and approach the goal of zero-defect software."
-Chris Tapp, Field Applications Engineer, LDRA Ltd.
I"'ve found this standard to be an indispensable collection of expert information on exactly how modern software systems fail in practice. It is the perfect place to start for establishing internal secure coding guidelines. You won't find this information elsewhere, and, when it comes to software security, what you don't know is often exactly what hurts you."
-John McDonald, coauthor of "The Art of Software Security Assessment"
To create secure software, developers must know where the dangers lie. Particularly with the C language, it often is more difficult to identify insecure code, or code that makes implementation-dependent assumptions, than many experiencedprogrammers believe. For example, C contains nearly 200 explicitly undefined behaviors for which compilers are not required to provide any diagnostic warnings Code containing undefined behaviors may function properly in one version of a conforming compiler, and then not at all in a subsequent release of the same compiler.
"
The CERT C Secure Coding Standard"enumerates coding errors that frequently result in exploitable vulnerabilities and provides secure alternative solutions as well as secure coding guidelines. If followed, these guidelines will eliminate critical undefined behaviors and other coding errors that are the root causes of software vulnerabilities in C. This book provides a desktop reference documenting the first official release of the standard.