Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.

I am not a newbie programmer, actually have more than 10 years of experience, with a roughly half of that time been spent doing server side development for Windows. But security is still a "gray area" to me, so almost every time when I need to configure a service or a web site etc - I would have to go to MSDN or Wikipedia or, have to admit that, just resort to "trial-and-error change the settings and check if it works now" approach.

Can you recommend a book or a place on the web where all Windows related security infrastructure (transport layer security, user security, etc) explained and various available technologies/security options compared.

I am not after a very detailed "security internals" type of thing, because at my line of work I don't need to configure a production code, god forbid, just some basics so I would not need to go to Wikipedia when I see a "digest" to find out "what is this digest for? (message, usertoken, etc), what (certificate, certficate hash, etc) has been used to create the digest, etc" and feel less ignorant.

Thank you.

share|improve this question

migrated from programmers.stackexchange.com Jan 23 '12 at 21:19

This question came from our site for professional programmers interested in conceptual questions about software development.

You cite service, web site, protocol, user, infrastructure, and digest security. And you want a book to cover all of that specifically for Windows implementation, but not an 'internals' type of thing? That's a pretty broad surface to cover and I do not think you will find what you ask for. You are either looking for an 'internals' or an 'administration' book, unless you can qualify your question. –  schroeder Jan 24 '12 at 18:00

5 Answers 5

I recommend the Security Now podcast especially if you have some commute time. There is over 400 hours of of security information.

http://www.grc.com/securitynow.htm For an episode guide and transcripts.

GRC also has some good security tools and info.

http://twit.tv/sn Is the main site.

share|improve this answer

you can check this website http://www.windowsecurity.com/ , and also there are videos from pluralsight about windows security but they are a bit outdated ,sans institute also offers a good course and it can be found here https://www.sans.org/security-training/securing-windows-77-mid , search amazon for this book .NET-Developers-Guide-Windows-Security it is also very useful.

share|improve this answer

I agree the request is far too vague. But to get you started here is an older but still applicable general security practices overview from sans: http://www.sans.org/reading_room/whitepapers/bestprac/system-administrator-security-practices_657

And here is a book that should be exactly what you're looking for, as I feel you should look more towards the proper secure system administration area for now, then move onto the more detailed intricacies of security management. Also it's from Syngress publishing whom I tend to trust generally (non-affiliated): http://www.amazon.com/Security-Microsoft-Windows-System-Administrators/dp/1597495948

share|improve this answer

I've been slightly thrown off by the 'Windows' part of the question, but I think you're asking for some generic security info...?

Comptia offer a generic security certification. You might want to look into books related to studying for that or just check the exam objectives and check out the different topics.

However that isn't specific to Windows. There are a lot of things related to 'Windows Security'. There are some Microsoft Technet articles here that might be useful. (I've found their checklists to be quite useful)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.