Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletter Hub
Free Learning
Arrow right icon
timer SALE ENDS IN
0 Days
:
00 Hours
:
00 Minutes
:
00 Seconds
Crafting Secure Software
Crafting Secure Software

Crafting Secure Software: An engineering leader's guide to security by design

Arrow left icon
Profile Icon Greg Bulmash Profile Icon Thomas Segura
Arrow right icon
€18.99 per month
Full star icon Full star icon Full star icon Full star icon Full star icon 5 (1 Ratings)
Paperback Sep 2024 156 pages 1st Edition
eBook
€35.99
Paperback
€44.99
Subscription
Free Trial
Renews at €18.99p/m
Arrow left icon
Profile Icon Greg Bulmash Profile Icon Thomas Segura
Arrow right icon
€18.99 per month
Full star icon Full star icon Full star icon Full star icon Full star icon 5 (1 Ratings)
Paperback Sep 2024 156 pages 1st Edition
eBook
€35.99
Paperback
€44.99
Subscription
Free Trial
Renews at €18.99p/m
eBook
€35.99
Paperback
€44.99
Subscription
Free Trial
Renews at €18.99p/m

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing
Table of content icon View table of contents Preview book icon Preview Book

Crafting Secure Software

Introduction to the Security Landscape

Production endpoints have long been seen as attack points and are thus defended with robust measures. In response, attackers have pivoted to compromise applications in development. Tools and components, from your code editors to your build and delivery processes, are now under attack.

That’s what we want to focus on in this book—exploring and detailing how to develop secure applications. It focuses on points in the software development life cycle (SDLC) where your products or procedures could be compromised before going live and discusses ways you can prevent or defend against such attacks.

This book also includes real-world hack incidents. These incidents are intended to help break down how a hack happened—how the attackers gained access to applications, what they did with the applications, and how it impacted the company and its customers—to arm you with the necessary facts to keep your applications secure.

These facts serve two purposes:

  • Help you evaluate the recommendations in this book and develop effective strategies and implementations for your company
  • Provide verifiable data points to drive buy-in across the spectrum of stakeholders you influence

Note

When mentioning the companies involved in these incidents, please understand that the intent is not to shame them or create a sense of sensationalism. All stories shared in this book were already reported in the press. By not anonymizing them, the goal is to maintain transparency, allowing you to verify the details if you wish, while also saving you the effort of doing so.

GitGuardian has been helping companies defend their applications and resources since 2017 and has over 500,000 customers using their software and services with both on-premises and cloud options available.

This book is designed to give software development managers, department heads, and C-level professionals an evidence-based overview of the threat landscape for application development and provide actionable insights that will help their teams develop securely throughout the SDLC, from ideation to monitoring in production.

The evolving application security landscape

In 2022, the U.S. Bureau of Labor Statistics estimated that over 2 million people in the U.S. worked as software and web developers, programmers, and testers (category 15-1250, formerly 15-1130).1 The following is a graph charting the population growth in the category over a decade of available statistics. The bars show the absolute growth while the trend line represents the year-over-year (YoY) growth percentages.

Figure 1.1: Year-over-year growth percentage of developers in the US

Worldwide, the industry is expected to grow to over 28 million software developers in 2024.2 Thanks to complexity and specialization, a few of those developers work alone or create all the components of their software from scratch. They use software to build software, collaborate, deliver software, and provide backend services for their software, and monitor it all in production. All the software and services used by developers to create software are collectively called the software supply chain (SSC) and it has become more and more popular as an attack vector.

The growth in software supply chain attacks is not just anecdotal—it’s being quantified. The non-profit Identity Theft Resource Center reported that between 2018 and 2023, supply chain attacks rose 2,600% to represent over 15% of reported identity data theft in 2023.3 A year earlier, Help Net Security noted that supply chain attacks had outpaced malware as a source of data breaches.4 The European Union Agency for Cybersecurity, in their Foresight Cybersecurity Threats for 2030 report, listed supply chain compromise of software dependencies as their #1 threat by the end of the decade, based on both likelihood and impact, scoring 44% higher than ransomware.

Regulatory pressures to address software supply chain security are increasing as well. In US President Joe Biden’s 2021 Executive Order on Improving the Nation’s Cybersecurity, over 25% of the document focused on improvements in software supply chain security, including requiring both internal federal agency developers and external software vendors to provide more transparency about their processes and the provenance of their software.

Developing securely isn’t simply about avoiding issues in the future. It is about taking the right steps, the right precautions, and being able to document that for stakeholders, customers, and regulators. For example, the U.S. Securities and Exchange Commission requires all annual reports for publicly traded companies to include a section on how the company is managing cyber risk for fiscal years starting after December 15, 2023.5

Security awareness

The security culture of an organization is foundational to its ability to protect information, data, and employee and customer privacy. Companies are moving beyond reactive, episodic approaches to security and recognizing that effective enterprise-wide security requires a strategic, long-term approach, focusing more on reliable mechanisms, communication, and culture than lectures from IT and an ongoing stream of new policy mandates.

During the pandemic, industries and organizations saw their security cultures stagnate or decline. As many organizations transitioned to a work-from-home model, new security issues and concerns emerged, while the diaspora of knowledge workers made communication and education more challenging.

Threats such as ransomware can escape notice and do damage for months before detection, even in top-performing organizations. Ongoing awareness, understanding, and appropriate actions are required to ensure organizations’ data is safe and that employee and customer data is not compromised.

Security culture is a critical, must-have asset in the security toolbox. By assessing employees’ security awareness, behaviors, and culture, organizations can adapt their policies and training programs to the constantly changing threat landscape.

Regulatory compliance and legal considerations

While this will be addressed in greater detail in Chapter 7, Security Compliance and Certification, you should be aware that new legislation and regulations are being put in place at state, federal, and agency levels on multiple continents. Whether you make or simply use software, there's increasing pressure to ensure that not only the application but the information it processes is also secure.

These laws and regulations around reporting and compliance come on top of legal liability and reputational damage both for the institutions and their officers. The U.S. Securities and Exchange Commission has specifically gone after the CISO of one hacked company as part of its enforcement action. This will be discussed in detail later in the chapter. That comes on top of the company losing 64% of its market capitalization since the incident.

These laws and regulations are designed to prevent serious incidents with national or global impacts by ensuring that companies have effective strategies and practices in place.

Whether your company handles data or provides crucial services in banking and finance, transportation, utilities, or healthcare, you will face more scrutiny and responsibility from regulators and law enforcement. By adopting strong security measures, you can meet these challenges and ensure compliance, keeping your organization and its stakeholders safe.

Who are the threat actors?

Behind every cyber threat, there’s a threat actor: a person or group of people causing intentional harm by exploiting vulnerabilities in the cyber sphere. They are usually the perpetrators behind cyberattacks, and are often categorized by a variety of factors, including motive, type of attack, and targeted sector. As the frequency and sophistication of cyber threats continue to grow, so will the number of threat actors behind them.

Today, the cyber threat environment is arguably more dynamic than ever before, and threat actors are becoming more sophisticated. Understanding threat actors and their motives can help organizations better protect themselves from the damage these actors cause as they exploit vulnerabilities, compromise user identities with elevated privileges, evade security controls, damage or delete data, or manipulate sensitive information.

One of the larger developments in the security landscape over the years has been the rise of the advanced persistent threat (APT).

What is an APT?

According to the U.S. National Institute of Standards and Technology, an APT can be defined as follows:

An adversary with sophisticated levels of expertise and significant resources, allowing it, through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives, which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.

While this is the textbook definition, to put it more simply, APT stands for:

  1. Advanced: APTs have resources, skills, and organization. Contrary to the stereotypical image depicted in popular media, they are professionals, often trained by state agencies, and sometimes still employed (or sanctioned) by them.
  2. Persistent: APT actors typically set up camps, take measures to avoid detection, create backdoors to get back in if you detect and close their main entry point, and move laterally throughout compromised systems to find more things to steal or damage and more connected systems to infiltrate.
  3. Threat: Needs no explanation.

APTs include organized professionals that pull off data thefts, cryptocurrency thefts, ransomware, corporate espionage, state-sponsored espionage, and even terrorism. In many cases, it’s more than one motive and it’s profitable. As this book details hacks, it will discuss APT groups and their methods in more detail.

Chainalysis, in their 2024 Crypto Crime Report, claimed that ransomware became a billion-dollar business in 2023.6 This was an estimate of ransomware payments, exclusive of the damage done. Due to that damage, the cost of ransomware was even higher. For example, while the ransomware attack on MGM Resorts in 2023 did not result in a payment to the group that successfully infiltrated MGM’s systems, it’s estimated that the clean-up costs were around $100 million.

While some of the access they gain is through deception and social engineering, APTs have increasingly used supply chain attacks to gain footholds or seed vulnerabilities in corporate and even government systems. In this regard, the SolarWinds case serves as a textbook example.

Supply chain attack case: SolarWinds

The SolarWinds supply chain attack is an example of the ability to use a successful incursion into a supply chain node to seed vulnerabilities well beyond the compromised system.

The company describes its Orion software as a “powerful, scalable infrastructure monitoring and management platform designed to simplify IT administration for on-premises, hybrid, and software as a service (SaaS) environments.

In 2020, customers using that software were notified of an update offering the usual fare of bug fixes and feature updates. The update had been compromised by an APT believed to be affiliated with the Russian intelligence service (the SVR), and infected with malware.

In later interviews, the CEO estimated that 18,000 customers downloaded the adulterated update.7 This was just a trick to get the customers to download a bad update from a website with some deceptive variation on the company name that might escape cursory inspection by a harried office worker. The APT had compromised SolarWinds’ systems and inserted the malware in an official update package without being noticed.

In an attack staged over the course of seven months, the hackers obtained access to the SolarWinds network, tested that access to ensure they could execute their hack, injected malicious code into the software, and caused Orion customers to start receiving updates containing the malicious software.

Notable entities such as Microsoft, the U.S. Postal Service, the U.S. Department of Energy, and the U.S. Department of Homeland Security received and were impacted by the malicious code. Because of the privileges the software needed to perform its “infrastructure monitoring and management” duties, the hackers received backdoor access to not only the data and networks of the companies using Orion but many of their customers too.

It’s estimated that up to 30,000 entities were potentially vulnerable, though the actual exploitation of the vulnerability is believed to be significantly lower. According to security agency FireEye, even after being infected with the compromised update, “these compromises are not self-propagating; each of the attacks requires meticulous planning and manual interaction."8

As reinforcement of the accusation against Russia, the Biden administration tied its April 2021 package of sanctions against Russia, at least in part, to the SolarWinds supply chain attack.

Besides the immense reputational damage done to SolarWinds, the Securities and Exchange Commission (SEC) filed a lawsuit in October 2023 charging SolarWinds and their CISO with defrauding investors and failing to maintain adequate internal controls. Between the disclosure of the hack in 2020 and the filing of the SEC action in 2023, their stock fell by nearly 64% and the SEC action seeks to bar their CISO from being an officer or director of a public corporation for the rest of his life.

Not every hack is a hack

Along with real stories of hacks, the internet is littered with sensationalized stories of hacks.

For example, in 2021, many news outlets reported that the city of Oldsmar, Florida, had been hacked to poison its water system, which served approximately 15,000 people.9 In this case, systems that add lye to the water supply to reduce acidity in the water were altered to increase the amount by approximately 11,000 percent. The alteration was caught in time and reversed by an alert employee who prevented it from causing actual harm.

No further details were released on who might be responsible or how they gained access to Oldsmar’s systems as the FBI and the Pinellas County Sheriff conducted their investigation. And that was the story until 2023. During a cybersecurity panel at a meeting of the American Society for Public Administration, the former city manager admitted that the FBI’s conclusion, after a four-month investigation, was that it wasn’t a hack. It was an employee error.10

While some of the hacks discussed in this book will be old enough at the time of writing to have been thoroughly covered and vetted, some more recent stories may appear simply because they provide the best illustration of a concept in the opinion of the authors. These facts have been vetted as thoroughly as possible before publication.

Where GitGuardian stands in the landscape

The proliferation of cloud services has expanded the attack surface for cybercriminals. According to IBM’s 2023 Cost of a Data Breach, 82% of breaches involved data stored in the cloud.11

One of those cloud storage services is well known to developers: GitHub. GitHub neither created nor owns Git, a popular tool for version control, source code management, and code collaboration. It is, however, the most popular Git service provider in the world.

In 2017, two French data scientists notes that their contemporaries often included plain-text credentials in the scripts and apps they wrote and they wanted to see how common it was. Since GitHub has one of the largest collections of publicly available source code in the world, they decided to scan it for credentials.

As they refined their algorithms to catch more and weed out false positives, the numbers grew more shocking. In their 2024 State of Secrets Sprawl report, GitGuardian found over 12.8 million new instances of secrets committed to GitHub repositories in 2023, an increase of over 28% from the prior year.

When the French scientists first discovered this in 2017, they started letting people know that their passwords, API keys, and other secret credentials were sitting in public view on GitHub and soon signed their first customer for a tool to detect and prevent secrets sprawl. That was how GitGuardian came into being and found its first client.

Since then, GitGuardian has built hundreds of specific detectors, provides free services to smaller developer teams, and helps clients ranging from SMBs to Fortune 500 companies find, remove, remediate, and prevent exposed credentials in their source code.

GitGuardian has expanded and improved its offering and services. It now provides the following:

  • Both cloud and on-premises solutions for detecting and remediating leaked secrets
  • The ability to scan multiple types of software artifacts and developer tools for secret leaks
  • Honeypot credentials called honeytokens to help detect when/where hackers find your secrets

Summary

In this chapter, we’ve discussed the threat landscape, threat actors, and why your security is important to you, your customers, and governments around the world. We’ve shown how one company’s security incident became a threat to national security and how the government responded by punishing both the country responsible for the hack and the hacked company for its allegedly inadequate and deceptive response.

Jeff Bezos is famously credited with the following quote: “Good intentions don’t work, mechanisms do.12 Alternatively “mechanisms > intentions” (mechanisms are greater than intentions) is used within Amazon’s culture.

This is intended to mean that even the best intentions will not guarantee the best results. Corners get cut and steps get skipped by the best of us, not maliciously, but out of forgetfulness, distraction, or logic that seemed sound at the time. By creating mechanisms as a forcing function to keep those corners un-cut and those steps un-skipped, those intentions get realized more fully and more often.

As this book progresses and the different points at which the software supply chain is attacked are examined, you will explore strategies for implementing training, tools, and mechanisms across the SDLC to fortify your organization’s defenses and develop secure applications.

Left arrow icon Right arrow icon

Key benefits

  • Develop a strong security posture by grasping key attack vectors in the SDLC
  • Implement industry-leading best practices to protect software from evolving threats
  • Utilize legislative and regulatory landscapes to mitigate compliance-related costs

Description

Drawing from GitGuardian's extensive experience in securing millions of lines of code for organizations worldwide, Crafting Secure Software takes you on an exhaustive journey through the complex world of software security and prepares you to face current and emerging security challenges confidently. Authored by security experts, this book provides unique insights into the software development lifecycle (SDLC) and delivers actionable advice to help you mitigate and prevent risks. From securing code-writing tools and secrets to ensuring the integrity of the source code and delivery pipelines, you’ll get a good grasp on the threat landscape, uncover best practices for protecting your software, and craft recommendations for future-proofing against upcoming security regulations and legislation. By the end of this book, you’ll have gained a clear vision of the improvements needed in your security posture, along with concrete steps to implement them, empowering you to make informed decisions and take decisive action in safeguarding your software assets.

Who is this book for?

This book is an essential read for security and IT leaders navigating the complexities of modern software development. The book is also useful for chief security officers (CSOs), chief information security officers (CISOs), security architects, DevOps professionals, and IT decision makers. A basic understanding of software engineering, version control, and build and delivery mechanisms is needed. This guide will empower you to comprehend and mitigate threats in today's dynamic software factories, regardless of your technical depth.

What you will learn

  • Get to grips with security trends and GitGuardian's role in modern software
  • Analyze major security breaches and their impact on the industry
  • Develop a threat model tailored to your business and risk appetite
  • Implement security measures across your entire SDLC
  • Secure secrets within codebases, configurations, and artifacts
  • Design and maintain secure build pipelines and deployment setups
  • Navigate security compliance, including current and future laws
  • Prepare for future security with AI-generated code integration

Product Details

Country selected
Publication date, Length, Edition, Language, ISBN-13
Publication date : Sep 12, 2024
Length: 156 pages
Edition : 1st
Language : English
ISBN-13 : 9781835885062
Vendor :
GitGuardian
Category :
Tools :

What do you get with a Packt Subscription?

Free for first 7 days. $19.99 p/m after that. Cancel any time!
Product feature icon Unlimited ad-free access to the largest independent learning library in tech. Access this title and thousands more!
Product feature icon 50+ new titles added per month, including many first-to-market concepts and exclusive early access to books as they are being written.
Product feature icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Product feature icon Thousands of reference materials covering every tech concept you need to stay up to date.
Subscribe now
View plans & pricing

Product Details

Publication date : Sep 12, 2024
Length: 156 pages
Edition : 1st
Language : English
ISBN-13 : 9781835885062
Vendor :
GitGuardian
Category :
Tools :

Packt Subscriptions

See our plans and pricing
Modal Close icon
€18.99 billed monthly
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Simple pricing, no contract
€189.99 billed annually
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts
€264.99 billed in 18 months
Feature tick icon Unlimited access to Packt's library of 7,000+ practical books and videos
Feature tick icon Constantly refreshed with 50+ new titles a month
Feature tick icon Exclusive Early access to books as they're written
Feature tick icon Solve problems while you work with advanced search and reference features
Feature tick icon Offline reading on the mobile app
Feature tick icon Choose a DRM-free eBook or Video every month to keep
Feature tick icon PLUS own as many other DRM-free eBooks or Videos as you like for just €5 each
Feature tick icon Exclusive print discounts

Frequently bought together


Stars icon
Total 120.97
In-Memory Analytics with Apache Arrow
€37.99
Data Engineering Best Practices
€37.99
Crafting Secure Software
€44.99
Total 120.97 Stars icon

Table of Contents

9 Chapters
Chapter 1: Introduction to the Security Landscape Chevron down icon Chevron up icon
Chapter 2: The Software Supply Chain and the SDLC Chevron down icon Chevron up icon
Chapter 3: Securing Your Code-Writing Tools Chevron down icon Chevron up icon
Chapter 4: Securing Your Secrets Chevron down icon Chevron up icon
Chapter 5: Securing Your Source Code Chevron down icon Chevron up icon
Chapter 6: Securing Your Delivery Chevron down icon Chevron up icon
Chapter 7: Security Compliance and Certification Chevron down icon Chevron up icon
Chapter 8: Best Practices to Drive Security Buy-In Chevron down icon Chevron up icon
Other Books You May Enjoy Chevron down icon Chevron up icon

Customer reviews

Rating distribution
Full star icon Full star icon Full star icon Full star icon Full star icon 5
(1 Ratings)
5 star 100%
4 star 0%
3 star 0%
2 star 0%
1 star 0%
Zardus Sep 22, 2024
Full star icon Full star icon Full star icon Full star icon Full star icon 5
Decent overview of the security considerations of a dev-project.
Subscriber review Packt
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial

FAQs

What is included in a Packt subscription? Chevron down icon Chevron up icon

A subscription provides you with full access to view all Packt and licnesed content online, this includes exclusive access to Early Access titles. Depending on the tier chosen you can also earn credits and discounts to use for owning content

How can I cancel my subscription? Chevron down icon Chevron up icon

To cancel your subscription with us simply go to the account page - found in the top right of the page or at https://subscription.packtpub.com/my-account/subscription - From here you will see the ‘cancel subscription’ button in the grey box with your subscription information in.

What are credits? Chevron down icon Chevron up icon

Credits can be earned from reading 40 section of any title within the payment cycle - a month starting from the day of subscription payment. You also earn a Credit every month if you subscribe to our annual or 18 month plans. Credits can be used to buy books DRM free, the same way that you would pay for a book. Your credits can be found in the subscription homepage - subscription.packtpub.com - clicking on ‘the my’ library dropdown and selecting ‘credits’.

What happens if an Early Access Course is cancelled? Chevron down icon Chevron up icon

Projects are rarely cancelled, but sometimes it's unavoidable. If an Early Access course is cancelled or excessively delayed, you can exchange your purchase for another course. For further details, please contact us here.

Where can I send feedback about an Early Access title? Chevron down icon Chevron up icon

If you have any feedback about the product you're reading, or Early Access in general, then please fill out a contact form here and we'll make sure the feedback gets to the right team. 

Can I download the code files for Early Access titles? Chevron down icon Chevron up icon

We try to ensure that all books in Early Access have code available to use, download, and fork on GitHub. This helps us be more agile in the development of the book, and helps keep the often changing code base of new versions and new technologies as up to date as possible. Unfortunately, however, there will be rare cases when it is not possible for us to have downloadable code samples available until publication.

When we publish the book, the code files will also be available to download from the Packt website.

How accurate is the publication date? Chevron down icon Chevron up icon

The publication date is as accurate as we can be at any point in the project. Unfortunately, delays can happen. Often those delays are out of our control, such as changes to the technology code base or delays in the tech release. We do our best to give you an accurate estimate of the publication date at any given time, and as more chapters are delivered, the more accurate the delivery date will become.

How will I know when new chapters are ready? Chevron down icon Chevron up icon

We'll let you know every time there has been an update to a course that you've bought in Early Access. You'll get an email to let you know there has been a new chapter, or a change to a previous chapter. The new chapters are automatically added to your account, so you can also check back there any time you're ready and download or read them online.

I am a Packt subscriber, do I get Early Access? Chevron down icon Chevron up icon

Yes, all Early Access content is fully available through your subscription. You will need to have a paid for or active trial subscription in order to access all titles.

How is Early Access delivered? Chevron down icon Chevron up icon

Early Access is currently only available as a PDF or through our online reader. As we make changes or add new chapters, the files in your Packt account will be updated so you can download them again or view them online immediately.

How do I buy Early Access content? Chevron down icon Chevron up icon

Early Access is a way of us getting our content to you quicker, but the method of buying the Early Access course is still the same. Just find the course you want to buy, go through the check-out steps, and you’ll get a confirmation email from us with information and a link to the relevant Early Access courses.

What is Early Access? Chevron down icon Chevron up icon

Keeping up to date with the latest technology is difficult; new versions, new frameworks, new techniques. This feature gives you a head-start to our content, as it's being created. With Early Access you'll receive each chapter as it's written, and get regular updates throughout the product's development, as well as the final course as soon as it's ready.We created Early Access as a means of giving you the information you need, as soon as it's available. As we go through the process of developing a course, 99% of it can be ready but we can't publish until that last 1% falls in to place. Early Access helps to unlock the potential of our content early, to help you start your learning when you need it most. You not only get access to every chapter as it's delivered, edited, and updated, but you'll also get the finalized, DRM-free product to download in any format you want when it's published. As a member of Packt, you'll also be eligible for our exclusive offers, including a free course every day, and discounts on new and popular titles.