Practical Security
Simple Practices for Defending Your Systems
by Roman Zabicki
Version: P1.0 (February 2019)
Copyright 2019 The Pragmatic Programmers, LLC. This book is licensed to the individual who purchased it. We don't copy-protect it because that would limit your ability to use it for your own purposes. Please don't break this trustyou can use this across all of your devices but please do not share this copy with other members of your team, with friends, or via file sharing services. Thanks.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and The Pragmatic Programmers, LLC was aware of a trademark claim, the designations have been printed in initial capital letters or in all capitals. The Pragmatic Starter Kit, The Pragmatic Programmer, Pragmatic Programming, Pragmatic Bookshelf and the linking g device are trademarks of The Pragmatic Programmers, LLC.
Every precaution was taken in the preparation of this book. However, the publisher assumes no responsibility for errors or omissions, or for damages that may result from the use of information (including program listings) contained herein.
About the Pragmatic Bookshelf
The Pragmatic Bookshelf is an agile publishing company. Were here because we want to improve the lives of developers. We do this by creating timely, practical titles, written by programmers for programmers.
Our Pragmatic courses, workshops, and other products can help you and your team create better software and have more fun. For more information, as well as the latest Pragmatic titles, please visit us at http://pragprog.com.
Our ebooks do not contain any Digital Restrictions Management, and have always been DRM-free. We pioneered the beta book concept, where you can purchase and read a book while its still being written, and provide feedback to the author to help make a better book for everyone. Free resources for all purchasers include source code downloads (if applicable), errata and discussion forums, all available on the book's home page at pragprog.com. Were here to make your life easier.
New Book Announcements
Want to keep up on our latest titles and announcements, and occasional special offers? Just create an account on pragprog.com (an email address and a password is all it takes) and select the checkbox to receive newsletters. You can also follow us on twitter as @pragprog.
About Ebook Formats
If you buy directly from pragprog.com, you get ebooks in all available formats for one price. You can synch your ebooks amongst all your devices (including iPhone/iPad, Android, laptops, etc.) via Dropbox. You get free updates for the life of the edition. And, of course, you can always come back and re-download your books when needed. Ebooks bought from the Amazon Kindle store are subject to Amazon's polices. Limitations in Amazon's file format may cause ebooks to display differently on different devices. For more information, please see our FAQ at pragprog.com/frequently-asked-questions/ebooks. To learn more about this book and access the free resources, go to https://pragprog.com/book/rzsecur, the book's homepage.
Thanks for your continued support,
Andy Hunt
The Pragmatic Programmers
The team that produced this book includes: Andy Hunt (Publisher) Janet Furlow (VP of Operations) Susan Conant (Managing Editor) Adaobi Obi Tulton (Development Editor) Molly McBeath (Copy Editor) Gilson Graphics (Layout)
For customer support, please contact .
For international rights, please contact .
To Marnie
Thanks for all the geek time
Table of Contents
Copyright 2019, The Pragmatic Bookshelf.
Early praise for Practical Security
Figuring out where to begin securing systems can seem like an insurmountable task. Practical Security lays out the basics of how to handle high-risk areas so that small organizations and developers can start their security journey.
Michael C. Brown |
Senior Security Engineer |
This book has the most down-to-earth, actionable advice for anyone who connects their valuables to the internet, from very small companies to the largest. While its pretty tough to make anything connected to your organization totally safe, following the practices in this book will significantly raise the cost to attackers.
William Lederer |
President, CIEX, Inc. |
A lot of security resources are targeted toward people who already know a lot about security, leaving a big gap for others who want to know how to keep their computers and networks safe. Roman provides accessible and practical advice that anyone can follow to get started.
Cade Cairns |
Security Engineer |
A good overview of important topics when getting started with security in a small organization, complete with in-depth explanations of common issues and pointers to additional resources.
aschmitz |
Principal Security Consultant |
This book is an excellent introduction to some of the topics you need to be a secure software engineer. It is pleasurable to read and well written.
Adam Ringwood |
Threat Research Engineer |
Acknowledgments
First of all, thank you to my wife, Marnie, for all the geek time you gave me to finish this book. I appreciate all your patience.
Thank you to my editor, Adaobi. You answered so many questions and gave me a lot of good advice on making this book more readable.
Thank you to Security Bill for taking a chance on me and giving me my first job in computer security. From watching the movie Sneakers to this, its been a blast.
Thank you to the Pragmatic Bookshelf for agreeing to publish my book. I never thought Id be a published author some day.
Thank you to the Chicago Public Library. In particular, thank you to the Harold Washington and Conrad Sulzer branches. You gave me a nice, quiet place to write. Youre a place where I can sit for hours without feeling rushed or that I need to spend money. My mom took us to the Sulzer often when we were kids, and I loved to sit in the giant throne-like chairs and read. Going back to the Sulzer to write was a treat. Youre a treasure for the city.
Thank you, Mom. Youve always had a big pile of books waiting to be read, and youve always had a couple of writing projects going at any given time. Great Scott, that must have planted a seed in my mind!
Thank you to all of my reviewers. This book is a lot better because you took the time to review it. I was impressed by your attention to details both technical and aesthetic.In no particular order, thank you to Jeffery Stanford, Bill Lederer, Laurens Van Houtven, Adam Ringwood, Dominic Le, Scott Horowitz, Ben Sweet, Cade Cairns, Chris Wilken, Michael C. Brown, Joni Musa, Chris Walsh, and aschmitz.
Im not unique in relying on my spouse, editor, and reviewers. I am, however, uniquely lucky to have you in particular to lean on. Thank you, all.
Copyright 2019, The Pragmatic Bookshelf.
Introduction
It seems like hardly a week goes by without a high-profile computer breach. Why do these happen? How can you prevent them? This book doesnt have all the answers, but it does outline practices that make life harder for attackers and that help tide you over until you get a full-time security team in place.