The approach to web services has changed significantly in the last couple of years:
CPTTM's Java web services course (starting on Jan 19) will
reflect all these new approaches. If you have attended this course
before,
you may want to refresh your skills by taking this one again. Of course
it is also suitable for those new to web services. For more info, see http://www2.cpttm.org.mo/training/sdb/showCourse.do?courseCode=CM188-01-2006-C.
This book is full of good practical advice on how to write secure code. For example, we all know that user inputs are dangerous and must be validated. But it is just too easy to forget to do that. This book shows a great solution: Use a class UserInput to store a user input string. When you get the string from this object, it will perform validations on that string and it will require that you have set the validators beforehand. Then in your UI layer (JSP, ASP, Servlet, PHP, Tapestry), make sure you work with a UserInput object instead of a string.
In addition to practical generic techniques like this one, this book also covers many specific areas such as database, web, encryption, signing, random numbers, .NET, preventing DoS.
The above techniques are most useful to programmers. In addition, this book also introduces security principles in the design, testing and maintenance phases of development. Great reading for team leads, architects and project managers.
This book is available for borrowing at CPTTM Cyber-Lab. Many other books on software development are also available. Please see http://www2.cpttm.org.mo/cyberlab/mslib.
Have any questions, ideas or experiences regarding software development? Contact me at 781313 or kent at cpttm dot org dot mo.
Until next time,
Kent Tong