Bulletproof SSL and TLS (Anglais) Broché – 31 juillet 2014
|Neuf à partir de||Occasion à partir de|
Les clients ayant acheté cet article ont également acheté
Descriptions du produit
Aucun appareil Kindle n'est requis. Téléchargez l'une des applis Kindle gratuites et commencez à lire les livres Kindle sur votre smartphone, tablette ou ordinateur.
Pour obtenir l'appli gratuite, saisissez votre adresse e-mail ou numéro de téléphone mobile.
Détails sur le produit
En savoir plus sur l'auteur
Ivan is an active participant in the security community and you'll often find him speaking at security conferences such as Black Hat, RSA, OWASP AppSec, and others. He's currently Director of Application Security Research at Qualys.
Dans ce livre(En savoir plus)
Commentaires en ligne
Commentaires client les plus utiles sur Amazon.com (beta)
If you've ever ran the Qualys SSL Test on your site (if you haven't, definitely give it a try), and felt overwhelmed by all the output, then this book is the explainer you've been looking for. By the time you're done, you'll know what all the checks are, why the tool is recommending particular configurations, and how you can go about addressing them on your servers.
The future of the internet is TLS everywhere, and this is a must read guide for developers, administrators, and security folks alike.
Author Ivan Ristic's meticulously-researched book covers every important aspect of HTTPS, from cryptography, to public key infrastructure, to deployment and operations. Weighing in at a hefty 506 pages, it's unlikely that you'll read this book as I did, from cover-to-cover, so the author thoughtfully crafted the book with distinct sections so you can easily start with the content most important to your needs before (or instead of) reading anything else.
For security enthusiasts, there's excellent coverage of all of the major attacks against TLS and PKI over the last decade or so, from CA compromise to TLS protocol attacks like BEAST, CRIME, Lucky 13, and more. This book serves as an excellent resource on each of these attacks-- how they operate, and how to mitigate against them.
Web developers charged with keeping their sites fast as they move to HTTPS will appreciate nearly 30 pages of content on optimizing HTTPS for both the network and CPU, and fantastic coverage of OpenSSL will help you navigate the many functions of that powerful toolchain, even if your servers are running on other technologies. Thoughtful coverage on the tradeoffs between high security and interoperability problems is found in every chapter, to help you make the right decisions for your site's needs.
One of the best features about this book is its breadth of platform coverage; unlike many guides that cover only one particular implementation, Bulletproof SSL and TLS covers all of the major platforms including thorough sections on OpenSSL, Apache, Java/Tomcat, IIS, and Nginx, with comments and footnotes about more obscure platforms as appropriate.
The web is full of outdated, inaccurate, and conflicting information about how to configure and deploy HTTPS properly, which makes this book an invaluable reference which will remain on my desk for years to come.
As a software engineer, I read a lot of technical books. It's rare to see a book like this which combines so many different elements into a cohesive book. It could be split up into 2 books: one on the history/context of the development and vulnerabilities of SSL/TLS and another on using OpenSSL, configuring certs and servers. I'm glad it's all one book so I only need to recommend one! There aren't many books like this on the market on any topic. It's rare to see someone cover the basics of the theory, summary of attacks and mitigations, and trade-offs with deploying in the real world.
The book's binding and paper is great as well. If you properly break in the book, it will lie flat all the way from page 30 onward. I didn't have any problems reading it on a bed. I read this cover to cover in part of a weekend. It was a quick, fun and informative read. After reading this, you should be ready to dive into the RFCs.
My criticism is light. I don't think the wikipedia references have much value. Everyone knows you can search for things. I think using the URL shortener links are annoying. What happens when your server goes down? And I wish there was a quick reference appendix at the end which summarizes recommended future reading. There were some book recommendations throughout the book and a summary of important RFCs. It would be nice to have that all in one place.
This covers the role of SSL and TLS in every system and how they connect to each-other through algorithms and certificates, what different changes do, and when/why you should make them.
After reading, systems run smoother and in a more controlled manner because I am able to make specific adjustments that I otherwise would not have known.