安全工程
Security Engineering
Ross J. Anderson · 初版 2001 年
38人推荐
49位读者提及
60次提及
为什么值得读
- 指导在软件研发生命周期中融入安全设计
- 涵盖领域非常广泛，行文通俗易读
- 阐述经久不衰的核心安全工程原则与科学思维
一本关于构建可靠 distributed systems 的指南。该书由剑桥大学计算机安全教授 Ross John Anderson 撰写。它从安全专业人员的视角广泛涵盖了各类 distributed systems。内容极其详尽，强烈推荐给所有安全爱好者。
Hacker News 上怎么说
正在加载完整评论……
……是一本实战指南，教你很多“硬核”技能，而不是像针对iOS之类特定平台的书。或许可以搭配一本针对特定工具的书，比如《The IDA Pro Book》。3. 《安全工程》（Security Engineering）——这本书和《软件安全评估的艺术》（The Art of Software Security Assessment）挑一本读就行。两本虽然都是老书，但核心原则永不过时。你绝对应该读一本，因为它们……
…practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book. 3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they…
……“RSA 1024全部返回失败”简直毫无意义。我真希望大家能对踏踏实实的老派科学（比如安德森的著作）多点信心，而不是迷信这种噱头十足的活动。你们都该去看看同一位作者写的《安全工程》（Security Engineering），完全免费！www.cl.cam.ac.uk/~rja14/book.html
…with RSA 1024 were returned as fails" are totally meaningless. I wish people had more confidence in good old science (like Anderson's works) than glamorous events like this. You should all check out Security Engineering by the same author, it's free! www.cl.cam.ac.uk/~rja14/book.html
……第1条针对应用安全的补充，显然重点在移动应用上。3. 《软件安全评估的艺术》（The Art of Software Security Assessment），安全行业的圣经。对源代码审查特别有指导意义。4. 《安全工程》（Security Engineering，罗斯·安德森著），作为第3条的补充。对于把安全融入整个SDLC流程以及设计安全软件非常有指导意义。5. 《Web之困》（The Tangled Web），极佳的历史背景和出色的顶层概述……
…supplement to #1 for application security, obviously focused on mobile apps. 3. The Art of Software Security Assessment The bible of the security industry. Especially instructive for source code review. 4. Security Engineering (Ron Anderson) Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software. 5. The Tangled Web Excellent historical background and good high level overview…
……从《黑客攻防技术宝典：系统篇》（Hacking: The Art of Exploitation）起步，接着读《逆向工程核心原理》（Reversing: Secrets of Reverse Engineering）或者《实用逆向工程》（Practical Reverse Engineering）。与此同时，你还得读读《软件安全评估的艺术》和《安全工程》，来培养过硬的源码审计和二进制渗透测试技能。坦白说，无论你在安全领域干哪行，这些书都必读。5. 拿到有竞争力的薪酬是完全可能的……
…with Hacking: The Art of Exploitation and then proceed to Reversing: Secrets of Reverse Engineering or Practical Reverse Engineering. You'll also want to read The Art of Software Security Assessment and Security Engineering alongside those, to develop excellent source code auditing and binary penetration testing skills. Frankly you should read those no matter what you do in security. 5. It's very possible to earn a competitive…
罗斯·安德森（Ross Anderson）的《安全工程》（Security Engineering）是一本极好的入门书。通俗易懂，涉猎广泛但挖得不算太深。第一版在网上免费公开（而且依然是极佳的参考资料；第二版增加了一些章节）：http://www.cl.cam.ac.uk/~rja14/book.html
Ross Anderson's Security Engineering is an excellent introductory book. Highly readable, and broad but not very deep. The first edition is free online (and is still a perfectly resource; the second edition has a few added chapters): http://www.cl.cam.ac.uk/~rja14/book.html
……想看防御措施的话，参考《计算机子系统物理安全设备：攻击与防御综述》（Physical Security Devices for Computer Subsystems: A Survey of Attacks and Defences）http://www.atsec.com/downloads/pdf/phy_sec_dev.pdf。如果我没记错的话，罗斯·安德森的《安全工程》里也有一章专门讲这个：https://www.cl.cam.ac.uk/~rja14/book.html（页面底部有完整的第1版）。编辑补充：克里斯·塔诺夫斯基（Chris Tarnovsky）以及他在卫星电视智能卡方面的工作经历也是个……
…at the defense measures, see "Physical Security Devices for Computer Subsystems: A Survey of Attacks and Defences" http://www.atsec.com/downloads/pdf/phy_sec_dev.pdf IIRC there's a chapter on it in "Security Engineering" by Ross Anderson, too: https://www.cl.cam.ac.uk/~rja14/book.html (whole 1st edition is at the bottom of the page) Edit: The story of Chris Tarnovsky and his work in satellite TV smartcards is also a…