Derek Fisher - Böcker

Stop dangerous threats and secure your vulnerabilities without slowing down delivery. This practical book is a one-stop guide to implementing a robust application security program.Application Security Program Handbook teaches you to implement a robust program of security throughout your development process. It goes well beyond the basics, detailing a flexible approach that can adapt and evolve to new and emerging threats. Follow the expert advice in this guide and you'll reliably deliver software that is free from security defects and critical vulnerabilities.

As a developer, you must build security into your software throughout its development lifecycle. This book addresses all the practices, tools, technology, people, and processes you need to reduce the risk of attacks and vulnerabilities in your software.

Application Security Program Handbook is full of strategies for setting up and maturing a security program for your development process. Its realistic recommendations take a service-oriented approach to application security that's perfectly suited to the fast-pace of modern development. Focused on the realities of software development, it shows you how to avoid making security a gated exercise.Inside, you'll learn to assess the current state of your app's security, identify key risks to your organization, and measure the success of any defensive programs you deploy. You'll master common methodologies and practices that help safeguard your software, along with defensive tools you can use to keep your apps safe. With this handy reference guide by your side, you'll be able to implement reliable security in a way that doesn't impact your delivery speed.

RETAIL SELLING POINTS

 Application security tools you can use throughout the development lifecycle   Creating threat models   Mitigating web app vulnerabilities   Creating a DevSecOps pipeline   Application security as a service model   Reporting structures that highlight the value of application security   Creating a software security ecosystem that benefits development

AUDIENCE

For software developers, architects, team leaders, and project managers looking to implement security in their pipelines.

Build threat modeling skills with practical advanced techniques to enhance risk analysis, optimize security measures, and stay ahead of emerging threats in the complex cybersecurity landscapeFree with your book: DRM-free PDF version + access to Packt's next-gen Reader*Key FeaturesIdentify and mitigate security threats across software, cloud, mobile, IoT, and supply chains using STRIDE, PASTA, and MITRE ATT&CKLearn from real-world case studies showing practical threat modeling applications across industriesBuild threat modeling programs with the right team, tools, SDLC integration, and continuous improvementBook DescriptionThreat modeling has become a cornerstone of modern cybersecurity, yet it is often overlooked, leaving security gaps that attackers can exploit. With the rise in system complexity, cloud adoption, AI-driven threats, and stricter compliance requirements, security teams need a structured approach to proactively spot and stop risks before attackers do. This book delivers exactly that, offering actionable insights for applying industry best practices and emerging technologies to secure systems. It breaks down the fundamentals of threat modeling and walks you through key frameworks and tools such as STRIDE, MITRE ATT&CK, PyTM, and Attack Paths, helping you choose the right model and create a roadmap tailored to your business. You'll learn how to use leading threat modeling tools, identify and prioritize potential threats, and integrate these practices into the software development life cycle to detect risks early. The book also examines how AI can enhance analysis and streamline security decision-making for faster, stronger defenses.By the end, you'll have everything you need to build systems that anticipate and withstand evolving threats, keeping your organization secure in an ever-changing digital landscape.*Email sign-up and proof of purchase requiredWhat you will learnCreate foundational threat modeling artifacts like Data Flow Diagrams and security architecture diagrams to visualize system threatsUnderstand the relationship between vulnerabilities (exploitable weaknesses) and threats (sources of harm)Analyze real-world case studies to see how threat modeling is applied in industry incidentsEvaluate and compare popular threat modeling tools, both open source and commercialExplore advanced topics, including threat modeling for cloud environments and integrating with DevSecOpsWho this book is forThis book is for cybersecurity professionals, security consultants, penetration testers, and compliance managers seeking to integrate threat modeling into their assessment methodologies and client engagements. It’s also ideal for software architects, DevOps engineers, risk managers, and organizational leaders responsible for identifying, assessing, and mitigating security risks in their technological environments. Whether you’re new to threat modeling or looking to enhance your existing expertise, this book helps you with foundational knowledge as well as advanced techniques.