Enjoy fast, free delivery, exclusive deals, and award-winning movies & TV shows with Prime
Try Prime and start saving today with fast, free delivery

Kindle
$36.66

Available instantly

Paperback
$8.86 - $38.41

$38.41 with 30 percent savings

List Price: $54.99

FREE Returns

FREE delivery Wednesday, May 15

Select delivery location

Only 1 left in stock - order soon.

$$38.41 () Includes selected options. Includes initial monthly payment and selected options. Details

Ships from

Amazon

Ships from

Amazon

Sold by

Ayasun Shipping

Sold by

Ayasun Shipping

Returns

Eligible for Return, Refund or Replacement within 30 days of receipt

Returns

Eligible for Return, Refund or Replacement within 30 days of receipt

This item can be returned in its original condition for a full refund or replacement within 30 days of receipt.

Read full return policy

Payment

Secure transaction

Payment

Secure transaction

We work hard to protect your security and privacy. Our payment security system encrypts your information during transmission. We don’t share your credit card details with third-party sellers, and we don’t sell your information to others. Learn more

Details

Add a gift receipt for easy returns

$8.86

Connecting readers with great books since 1972! Used textbooks may not include companion materials such as access codes, etc. May have some wear or writing/highlighting. We ship orders daily and Customer Service is our top priority! Connecting readers with great books since 1972! Used textbooks may not include companion materials such as access codes, etc. May have some wear or writing/highlighting. We ship orders daily and Customer Service is our top priority! See less

$3.99 delivery May 16 - 22. Details

Or fastest delivery May 14 - 17. Details

Select delivery location

Only 1 left in stock - order soon.

$$38.41 () Includes selected options. Includes initial monthly payment and selected options. Details

Access codes and supplements are not guaranteed with used items.

Enhancements you chose aren't available for this seller. Details

${cardName} not available for the seller you chose

${cardName} unavailable for quantities greater than ${maxQuantity}.

Ships from and sold by HPB-Red.

Other sellers on Amazon

New & Used (14) from $8.86 + $3.99 shipping

Follow the authors

Image Unavailable

Image not available for
Color:

To view this video download Flash Player

CERT Oracle Secure Coding Standard for Java, The (SEI Series in Software Engineering) 1st Edition

by Fred Long (Author), Dhruv Mohindra Robert C. Seacord

4.5 18 ratings

Part of: SEI Series in Software Engineering (27 books)

See all formats and editions

{"desktop_buybox_group_1":[{"displayPrice":"$38.41","priceAmount":38.41,"currencySymbol":"$","integerValue":"38","decimalSeparator":".","fractionalValue":"41","symbolPosition":"left","hasSpace":false,"showFractionalPartIfEmpty":true,"offerListingId":"jJVRQqLJKMtVevf51zToTXaIiM9AxemKy1YC1NDPRfT2%2BKkZUi0%2B1Tr1O1xiz3GuoDpI50r0I%2FO48xGI0ftzM8JZB3W42RelU6ihvOTqJXatu2HDFDhQvTIcpmBHvyp6n95CkR8jfP3sSGZk7oJqonDT%2FdHHHcEp3FYYQ5tta9VKkEA7rHcKuRp9xWOzVkyk","locale":"en-US","buyingOptionType":"NEW","aapiBuyingOptionIndex":0}, {"displayPrice":"$8.86","priceAmount":8.86,"currencySymbol":"$","integerValue":"8","decimalSeparator":".","fractionalValue":"86","symbolPosition":"left","hasSpace":false,"showFractionalPartIfEmpty":true,"offerListingId":"jJVRQqLJKMtVevf51zToTXaIiM9AxemKBBM3viimyK56QrPt5F3uEwTEJrvoT5OzgCHoFmEdJsO1F5Igh5IiK315q%2BHmohTYnqkDhoHB9GKaW4Ykl%2B%2FX%2BVz5fLUFQ7Z6evWtPtznvJkkYhDvcqISe%2FW%2FO2oj%2F%2FQ2AHI9XGvjWkasdUY%2B8lP%2BO2HzZZ7RYvF2","locale":"en-US","buyingOptionType":"USED","aapiBuyingOptionIndex":1}]}

Purchase options and add-ons

“In the Java world, security is not viewed as an add-on a feature. It is a pervasive way of thinking. Those who forget to think in a secure mindset end up in trouble. But just because the facilities are there doesn’t mean that security is assured automatically. A set of standard practices has evolved over the years. The Secure® Coding® Standard for JavaTM is a compendium of these practices. These are not theoretical research papers or product marketing blurbs. This is all serious, mission-critical, battle-tested, enterprise-scale stuff.”

―James A. Gosling, Father of the Java Programming Language

An essential element of secure coding in the Java programming language is a well-documented and enforceable coding standard. Coding standards encourage programmers to follow a uniform set of rules determined by the requirements of the project and organization, rather than by the programmer’s familiarity or preference. Once established, these standards can be used as a metric to evaluate source code (using manual or automated processes).

The CERT® Oracle® Secure Coding Standard for JavaTM provides rules designed to eliminate insecure coding practices that can lead to exploitable vulnerabilities. Application of the standard’s guidelines will lead to higher-quality systems–robust systems that are more resistant to attack. Such guidelines are required for the wide range of products coded in Java–for devices such as PCs, game players, mobile phones, home appliances, and automotive electronics.

After a high-level introduction to Java application security, seventeen consistently organized chapters detail specific rules for key areas of Java development. For each area, the authors present noncompliant examples and corresponding compliant solutions, show how to assess risk, and offer references for further information. Each rule is prioritized based on the severity of consequences, likelihood of introducing exploitable vulnerabilities, and cost of remediation.

The standard provides secure coding rules for the Java SE 6 Platform including the Java programming language and libraries, and also addresses new features of the Java SE 7 Platform. It describes language behaviors left to the discretion of JVM and compiler implementers, guides developers in the proper use of Java’s APIs and security architecture, and considers security concerns pertaining to standard extension APIs (from the javax package hierarchy).The standard covers security issues applicable to these libraries: lang, util, Collections, Concurrency Utilities, Logging, Management, Reflection, Regular Expressions, Zip, I/O, JMX, JNI, Math, Serialization, and JAXP.

Frequently bought together

CERT Oracle Secure Coding Standard for Java, The (SEI Series in Software Engineering)

$38.41

Get it as soon as Wednesday, May 15

Only 1 left in stock - order soon.

Sold by Ayasun Shipping and ships from Amazon Fulfillment.

+

Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs: 75 Recommendations for Reliable and Secure Progr

$39.97

Get it as soon as Wednesday, May 15

Only 1 left in stock - order soon.

Sold by Ellie's Bookstore and ships from Amazon Fulfillment.

Total price:

To see our price, add these items to your cart.

Try again!

Details

Added to Cart

These items are shipped from and sold by different sellers.

Show details Hide details

Choose items to buy together.

Fred Long
31
Paperback
23 offers from $1.01

Editorial Reviews

About the Author

Ve>Fred Long is a senior lecturer and director of learning and teaching in the Department of Computer Science, Aberystwyth University in the United Kingdom. He lectures on formal methods; Java, C++, and C programming paradigms and programming-related security issues. He is chairman of the British Computer Society’s Mid-Wales Sub-Branch. Fred has been a Visiting Scientist at the Software Engineering Institute since 1992. Recently, his research has involved the investigation of vulnerabilities in Java.

Dhruv Mohindra is a senior software engineer at Persistent Systems Limited, India, where he develops monitoring software for widely used enterprise servers. He has worked for CERT at the Software Engineering Institute and continues to collaborate to improve the state of security awareness in the programming community.

Dhruv has also worked for Carnegie Mellon University, where he obtained his master of science degree in information security policy and management. He holds an undergraduate degree in computer engineering from Pune University, India, where he researched with Calsoft, Inc., during his academic pursuit.

A writing enthusiast, Dhruv occasionally contributes articles to technology magazines and online resources. He brings forth his experience and learning from developing and securing service oriented applications, server monitoring software, mobile device applications, web-based data miners, and designing user-friendly security interfaces.

Robert C. Seacord is a computer security specialist and writer. He is the author of books on computer security, legacy system modernization, and component-based software engineering.

Robert manages the Secure Coding Initiative at CERT, located in Carnegie Mellon’s Software Engineering Institute in Pittsburgh, Pennsylvania. CERT, among other security-related activities, regularly analyzes software vulnerability reports and assesses the risk to the Internet and other critical infrastructure. Robert is an adjunct professor in the Carnegie Mellon University School of Computer Science and in the Information Networking Institute.

Robert started programming professionally for IBM in 1982, working in communications and operating system software, processor development, and software engineering. Robert also has worked at the X Consortium, where he developed and maintained code for the Common Desktop Environment and the X Window System. Robert has a bachelor’s degree in computer science from Rensselaer Polytechnic Institute.

Dean F. Sutherland is a senior software security engineer at CERT. Dean received his Ph.D. in software engineering from Carnegie Mellon in 2008. Before his return to academia, he spent 14 years working as a professional software engineer at Tartan, Inc. He spent the last six of those years as a senior member of the technical staff and a technical lead for compiler backend technology. He was the primary active member of the corporate R&D group, was a key instigator of the design and deployment of a new software development process for Tartan, led R&D projects, and provided both technical and project leadership for the 12-person compiler back-end group.

David Svoboda is a software security engineer at CERT. David has been the primary developer on a diverse set of software development projects at Carnegie Mellon since 1991, ranging from hierarchical chip modeling and social organization simulation to automated machine translation (AMT). His KANTOO AMT software, developed in 1996, is still in production use at Caterpillar. He has over 13 years of Java development experience, starting with Java 2, and his Java projects include Tomcat servlets and Eclipse plug-ins. David is also actively involved in several ISO standards groups: the JTC1/SC22/WG14 group for the C programming language and the JTC1/ SC22/WG21 group for C++.

Product details

Publisher ‏ : ‎ Addison-Wesley Professional; 1st edition (September 8, 2011)
Language ‏ : ‎ English
Paperback ‏ : ‎ 744 pages
ISBN-10 ‏ : ‎ 0321803957
ISBN-13 ‏ : ‎ 978-0321803955
Item Weight ‏ : ‎ 2.5 pounds
Dimensions ‏ : ‎ 7 x 1.5 x 9.25 inches

Best Sellers Rank: #2,607,577 in Books (See Top 100 in Books)
- #77 in Oracle Certification
- #779 in Java Programming
- #1,976 in Computer Programming Languages

Customer Reviews:
4.5 18 ratings

Brief content visible, double tap to read full content.

Full content visible, double tap to read brief content.

Videos

Help others learn more about this product by uploading a video!

Upload your video

About the authors

Follow authors to get new release updates, plus improved recommendations.

Fred Long
Brief content visible, double tap to read full content.
Full content visible, double tap to read brief content.
Fred Long is a senior lecturer in the Department of Computer Science, Aberystwyth University, UK.
He lectures on formal methods; Java, C++, and C programming paradigms and programming-related security issues.
He is chairman of the British Computer Society's Mid-Wales Sub-Branch.
Fred has been a Visiting Scientist at the Software Engineering Institute since 1992. Recently, his research has involved the investigation of vulnerabilities in Java.
See more on the author's page
Dean F. Sutherland
Brief content visible, double tap to read full content.
Full content visible, double tap to read brief content.
Dean F. Sutherland is a senior software security engineer at CERT. Dean received his Ph.D. in software engineering from Carnegie Mellon in 2008. Before his return to academia, he spent 14 years working as a professional software engineer at Tartan, Inc. He spent the last six of those years as a senior member of the technical staff and a technical lead for compiler backend technology. He was the primary active member of the corporate R&D group, was a key instigator of the design and deployment of a new software development process for Tartan, led R&D projects, and provided both technical and project leadership for the 12-person compiler back-end group.
See more on the author's page
Dhruv Mohindra
Brief content visible, double tap to read full content.
Full content visible, double tap to read brief content.
Dhruv Mahindra leads the Corporate Product Security Group at BMC Software. He is a coauthor of The CERT® Oracle® Secure Coding Standard for Java™ (Addison-Wesley, 2012) and Java™ Coding Guidelines: 75 Recommendations for Reliable and Secure Programs (Addison-Wesley, 2014). Dhruv's books have also been translated to Chinese, Korean and Japanese languages and are widely used as textbooks in institutes of higher learning.
See more on the author's page
Dean F. Sutherland
Brief content visible, double tap to read full content.
Full content visible, double tap to read brief content.
Discover more of the author’s books, see similar authors, read author blogs and more
See more on the author's page
Robert C. Seacord
Brief content visible, double tap to read full content.
Full content visible, double tap to read brief content.
Robert C. Seacord is a computer scientist, computer security specialist, and writer. He is the author of books on computer security, legacy system modernization, and component-based software engineering. He has a Bachelor in computer science from Rensselaer Polytechnic Institute.
Robert C. Seacord manages the Secure Coding Initiative at CERT, located in Carnegie Mellon’s Software Engineering Institute (SEI) in Pittsburgh, PA. CERT, among other security related activities, regularly analyzes software vulnerability reports and assesses the risk to the Internet and other critical infrastructure. Robert is an adjunct professor in the Carnegie Mellon University School of Computer Science and in the Information Networking Institute.
Robert started programming professionally for IBM in 1982, working in communications and operating system software, processor development, and software engineering. Robert also has worked at the X Consortium, where he developed and maintained code for the Common Desktop Environment and the X Window System.
See more on the author's page
David Svoboda
Brief content visible, double tap to read full content.
Full content visible, double tap to read brief content.
David Svoboda is a software security engineer at CERT. David has been the primary developer on a diverse set of software development projects at Carnegie Mellon since 1991, ranging from hierarchical chip modeling and social organization simulation to automated machine translation (AMT). His KANTOO AMT software, developed in 1996, is still in production use at Caterpillar. He has over 13 years of Java development experience, starting with Java 2, and his Java projects include Tomcat servlets and Eclipse plug-ins. David is also actively involved in several ISO standards groups: the JTC1/SC22/WG14 group for the C programming language and the JTC1/ SC22/WG21 group for C++.
See more on the author's page

Customer reviews

4.5 out of 5

18 global ratings

2 star

0%

1 star

0%

How customer reviews and ratings work

Sort reviews by

Top reviews from the United States

There was a problem filtering reviews right now. Please try again later.

Ben Rothke

CERT Oracle Secure Coding Standard for Java is a very useful resourc

Reviewed in the United States on October 12, 2011

It has been a decade since Oracle started their unbreakable campaign touting the security robustness of their products.

Aside from the fact that unbreakable only refers to the enterprise kernel; Oracle still can have significant security flaws.

Even though Java supports very strong security controls including JAAS (Java Authentication and Authorization Services), it still requires a significant effort to code Java securely.

With that, The CERT Oracle Secure Coding Standard for Java is an invaluable guide that provides the reader with the strong coding guidelines and practices in order to reduce coding vulnerabilities that can lead to Java and Oracle exploits.

The book is from CERT, and like other CERT books, provides both the depth and breadth necessary to gain mastery on the topic.

The book includes various rules and recommended practices for secure programming for Java SE6 and SE 7. Unfortunately, the book does not provide an on-line reference to version 1.0.

The book also covers the most common coding errors that lead to Java vulnerabilities and detail how they can be avoided.

For those using Java on Oracle and hoping to build secure applications, The CERT Oracle Secure Coding Standard for Java is a very useful resource that no programmer should be without.

The first 100 pages of the book are available here. After read it, you will be likely to want to see the next 650 pages.

7 people found this helpful

Helpful

JB

Good resoure for Java architects, developers, and application security auditors

Reviewed in the United States on April 4, 2012

Verified Purchase

"The CERT Oracle Secure Coding Standard for Java" is a thoroughly researched and authoritative guide to secure coding in Java. It specifically focuses on Java SE 6 and some of the features of Java SE 7, so don't look for coverage of security best practices for Java EE and certainly not for web application security issues that target aspects of HTTP, HTML, or JavaScript (e.g., Cross-Site Scripting, Cross-Site Request Forgery, etc.). The book actually goes beyond guidance for coding a secure application, providing insight into building a solid, high quality application. Indeed, in the Preface it notes that the goal of the rules is to help developers build "higher quality systems that are safe, secure, reliable, dependable, robust, resilient, available, and maintainable".

The coding standards are provided as a clearly documented set of rules, each one including some summary information about the rule, code examples of the rule not being followed as well as code that does follow the rule, enumerated exceptions where it's permissible to deviate from the rule, and lastly a risk assessment of the vulnerability that arises when you don't follow the rule. The list of rules is extensive, so the authors have helpfully grouped them into the following categories:

* Input Validation and Data Sanitization
* Declarations and Initialization
* Expressions
* Numeric Types and Operations
* Object Orientation
* Methods
* Exceptional Behavior (i.e., proper usage and handling of exceptions)
* Visibility and Atomicity
* Locking
* Thread APIs
* Thread Pools
* Thread-Safety Miscellaneous
* Input Output
* Serialization
* Platform Security
* Runtime Environment
* Miscellaneous

This presentation format lends itself to a very organized and comprehensive treatment of the subject, but doesn't make it the type of book that you can easily read from cover to cover. It would be fair to say that it reads more like a reference book that's tremendously useful when you're interested in practical secure Java coding practices for a specific area rather than as a training guide. Before finding that specific topic of interest, however, it would be wise to read the excellent introductory chapter. The introduction provides overviews of each of the principle sources of vulnerabilities in Java applications: misplaced trust; injection attacks (including a very helpful explanation of the appropriate use and sequencing of validation, sanitization, canonicalization, and normalization); leaking sensitive data; leaking capabilities; denial of service; serialization; concurrency, visibility, and memory; security managers; and class loaders.

It's also important to note that many of the rules focus on how to write mobile code that can be safely executed in untrusted systems or how to use untrusted mobile code on trusted systems. In these cases, the attacker is writing code that interacts with your code and takes advantage of vulnerabilities you have left by not following the prescribed rules. This attacker context is quite different from that of an external hacker trying to take advantage of flaws in a web site, for example.

Although the book is probably best used as a reference guide in which you'll seek out a topic of interest rather than read from front to back, it's undeniably a highly valuable contribution to the topic of secure Java coding. As such, it's a useful addition to the bookshelves of Java architects, developers, and application security auditors.

3 people found this helpful

Helpful

Luis Sanabria

Refernence Material

Reviewed in the United States on September 20, 2013

Verified Purchase

Nice reference material, but not very useful for the average developer. It has an small introductory chapter on secure coding practices and the remaining of the book is a list of common vulnerabilities and a short advise on how to avoid them, but it lacks details on how to identify and address them or on how the developers should change their programming practices to avoid introducing them in the first place. If you are looking for a book to help you code secure applications, you should look somewhere else.

Reviewed in the United States on December 24, 2012

Verified Purchase

Well-written book. Serves its purpose that my team is using it for. Every sprint they choose new security standards to address (and automate) and this book is a big help in that regard. Easy to dissect and find useful information.

Reviewed in the United States on October 4, 2011

Verified Purchase

Got chance to read this book over the weekend.

Positive: Code snippets for each scenario.

Most of the security issues are the ones we generally practice on day to day basis.
This is good book to have for Thread related issues.

3 people found this helpful

Helpful

Alexei Nekrassov

OK content but what's with the price??

Reviewed in the United States on December 2, 2011

The content may be good to trivial - depending on your level. But realize that this is a printout of content freely available on cert web site (with all the code samples and tables). Save the money (and the trees).

It would've been OK to pay 10 for paper copy, but how Amazon can charge 38 for paper version or 22 for kindle - is beyond me.

4 people found this helpful

Helpful

Top reviews from other countries

Montecedro Giovanni

Excellent book

Reviewed in the United Kingdom on March 15, 2015

Verified Purchase

A must read

mg

Does what is says on the cover

Reviewed in the United Kingdom on April 8, 2015

Verified Purchase

Massive detail, a little dull but that's the nature of the subject :)

See more reviews

Return this item for free

Follow the authors

Image Unavailable