第1 章 軟件與軟件安全······································································································1
1.1 軟件安全范疇········································································································1
1.1.1 軟件與軟件安全的定義····················································································1
1.1.2 軟件缺陷與漏洞·····························································································3
1.1.3 軟件漏洞分類································································································6
1.1.4 軟件安全與其他安全的關系···········································································.12
1.2 軟件安全現狀·····································································································.15
1.2.1 軟件安全總體情況·······················································································.15
1.2.2 系統軟件安全現狀·······················································································.17
1.2.3 應用軟件安全現狀·······················································································.18
1.2.4 開源軟件安全現狀·······················································································.19
1.3 安全事件的根源··································································································.21
1.3.1 軟件漏洞是安全問題的焦點···········································································.21
1.3.2 產生軟件漏洞的原因····················································································.24
1.4 緩解軟件安全問題的途徑與方法··········································································.27
1.4.1 緩解軟件安全問題的基本策略········································································.27
1.4.2 緩解軟件安全問題的工程化方法·····································································.28
1.4.3 軟件安全問題的標準化、規范化解決之路·························································.29
1.4.4 緩解軟件安全問題的技術探索與舉措·······························································.31
實踐任務···················································································································.34
任務1：相對路徑攻擊···························································································.34
任務2：SQL 注入攻擊··························································································.35
思考題······················································································································.35
第2 章 軟件的工程化安全方法·························································································.36
2.1 軟件工程概述·····································································································.36
2.1.1 軟件的發展過程··························································································.36
2.1.2 軟件危機···································································································.37
2.1.3 軟件工程···································································································.38
2.1.4 軟件生命周期·····························································································.40
2.2 軟件過程模型·····································································································.43
2.2.1 瀑布模型···································································································.44
2.2.2 快速原型模型·····························································································.45
2.2.3 增量模型···································································································.46
2.2.4 螺旋模型···································································································.47
2.2.5 微軟MSF 過程模型······················································································.48
2.3 軟件質量與軟件的安全特性·················································································.49
2.3.1 軟件質量···································································································.50
2.3.2 軟件的安全特性··························································································.52
2.3.3 軟件安全特性與軟件質量的關系······