Review By: Laura M. Hagar
04/07/2008My perspective is from CM/QA background and I'm grateful for the many references presented throughout the book that deal with configuration management, inspections, peer reviews, and coding standards. I was able to immediately use the information in the book in my line of work and have already recommended this book to developers and security professionals.

The author's message is clear, concise, and appropriate. Web application security is going to be a hot topic for at least three to five more years, yet security plans are most frequently left out in a project. To this, the author briefly describes why and how to produce a security plan, including who is responsible for the plan.

His message is easy to understand and he provides sound advice; the information is presented well to prove his points. It’s also as comprehensive as possible given the complexity of the material. There are fast-track solutions throughout the book, which are really helpful. I really enjoyed the points he makes at the ends of each chapter, which are short but can easily be dropped into a report to management.

This book is suited for both novices (to learn and change bad habits) and experts (as a reference and to mentor others), but is ideal for Web security professionals. I strongly encourage application developers, security professionals, and configuration management and QA personnel to read this book. Managers should also give it a skim to gain some insight into Web application security.

This book is a perfect companion to James Whittaker's book titled "How to Break Web Software," as well as Herb Thompson and Scott Chase's "The Software Vulnerability Guide."