Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.
I am not a newbie programmer, actually have more than 10 years of experience, with a roughly half of that time been spent doing server side development for Windows. But security is still a "gray area" to me, so almost every time when I need to configure a service or a web site etc - I would have to go to MSDN or Wikipedia or, have to admit that, just resort to "trial-and-error change the settings and check if it works now" approach.
Can you recommend a book or a place on the web where all Windows related security infrastructure (transport layer security, user security, etc) explained and various available technologies/security options compared.
I am not after a very detailed "security internals" type of thing, because at my line of work I don't need to configure a production code, god forbid, just some basics so I would not need to go to Wikipedia when I see a "digest" to find out "what is this digest for? (message, usertoken, etc), what (certificate, certficate hash, etc) has been used to create the digest, etc" and feel less ignorant.