 |
| [image source: Amazon] |
Book: Software Security for Developers: With Examples in Java and Spring
- https://www.amazon.com/Software-Security-Developers-examples-Spring/dp/1617298581
- https://www.manning.com/books/software-security-for-developers
Publisher: Manning
Publication Date: June 9, 2026
Authors:
Adib Saikalikali
Distinguished Software Engineer @ Tanzu
Toronto, Ontario, Canada
https://www.linkedin.com/in/adibsaikali/
Laurentiu Spilca
Principal Development Consultant, Endava
Bucharest, Romania
https://www.linkedin.com/in/laurspilca/?locale=en
Review Rating: 4-Stars
Review Title: A good book for an introduction to Software Security - for both Developers and Managers
I enjoyed reading this book. It is well-written, and provides a broad survey of important software security concepts and techniques – with easy to understand illustrations, descriptions, and code examples.
The companion GitHub repository provides 27 subfolders with Java & Spring examples.
Chapters 2-17 include a number of exercises (182), and at the end of the chapter there is a consistent approach in providing Exercise answers – as well as a Summary. The summary bullets are meaningful, and well written.
If the reader leverages the contents of each chapter, including the exercises, and the code examples – then this book will provide the diligent reader with a very HANDS-ON learning experience.
Some minor nits:
The naming convention of the folders in the companion GitHub repository for the book would have been better named using a consistent 2-character identifier for the chapter, and a 2-character identifier for the exercise - so that a natural sort order would be enforced.
"Single-sign on" is improperly written, it should be "Single sign-on"
page-v
page-211
page-335
While the writing is crisp & concise, and the coverage of the subject matter is *mostly* sufficient for a book of this length – there are three notable deficiencies:
1. The book suffers from a paucity of coverage for the very important topic of Post Quantum Cryptography (PQC).
Although the book was published in June 2026, there are only two pages (53, 75) that vaguely refer to NIST cryptographic algorithms standards – and neither of those mention the NIST work on Post Quantum Cryptography (PQC). Nor are there any "additional reading" suggestions.
Further, on Page-94, this statement is made:
"Cryptographers are building encryption algorithms that can resist quantum computers, but none has been standardized so far."
- This is incorrect.
On August 13, 2024, NIST released final versions of the first three Post Quantum Crypto Standards: FIPS 203, FIPS 204, and FIPS 205. [see NIST press release]
✅ Federal Information Processing Standard (FIPS) 203, intended as the primary standard for general encryption. Among its advantages are comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation. The standard is based on the CRYSTALS-Kyber algorithm, which has been renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism.
✅ FIPS 204, intended as the primary standard for protecting digital signatures. The standard uses the CRYSTALS-Dilithium algorithm, which has been renamed ML-DSA, short for Module-Lattice-Based Digital Signature Algorithm.
✅ FIPS 205, also designed for digital signatures. The standard employs the SPHINCS+ algorithm, which has been renamed SLH-DSA, short for Stateless Hash-Based Digital Signature Algorithm. The standard is based on a different math approach than ML-DSA, and it is intended as a backup method in case ML-DSA proves vulnerable.
On March 11, 2025 NIST released Hamming Quasi-Cyclic (HQC) as the fifth algorithm for post-quantum asymmetric encryption as used for key encapsulation / exchange.The new algorithm is as a backup for ML-KEM, the main algorithm for general encryption.
Additionally, there are international alternatives to the NIST standard, that could have been briefly cited, and links provided. For example, a Google search for this article by Akamai, 'A Guide to International Post-Quantum Cryptography Standards', published on Oct 08, 2025.
2. The book suffers from an absence of "further reading" suggestions for the important topic of Zero Trust.
3. The book does not mention Homomorphic Encryption.
No comments:
Post a Comment