Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.

I am not a newbie programmer, actually have more than 10 years of experience, with a roughly half of that time been spent doing server side development for Windows. But security is still a "gray area" to me, so almost every time when I need to configure a service or a web site etc - I would have to go to MSDN or Wikipedia or, have to admit that, just resort to "trial-and-error change the settings and check if it works now" approach.

Can you recommend a book or a place on the web where all Windows related security infrastructure (transport layer security, user security, etc) explained and various available technologies/security options compared.

I am not after a very detailed "security internals" type of thing, because at my line of work I don't need to configure a production code, god forbid, just some basics so I would not need to go to Wikipedia when I see a "digest" to find out "what is this digest for? (message, usertoken, etc), what (certificate, certficate hash, etc) has been used to create the digest, etc" and feel less ignorant.

Thank you.


migration rejected from Dec 29 '14 at 12:44

This question came from our site for professional programmers interested in conceptual questions about software development. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as off-topic by AviD Dec 29 '14 at 12:44

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

You cite service, web site, protocol, user, infrastructure, and digest security. And you want a book to cover all of that specifically for Windows implementation, but not an 'internals' type of thing? That's a pretty broad surface to cover and I do not think you will find what you ask for. You are either looking for an 'internals' or an 'administration' book, unless you can qualify your question. – schroeder Jan 24 '12 at 18:00

I agree the request is far too vague. But to get you started here is an older but still applicable general security practices overview from sans:

And here is a book that should be exactly what you're looking for, as I feel you should look more towards the proper secure system administration area for now, then move onto the more detailed intricacies of security management. Also it's from Syngress publishing whom I tend to trust generally (non-affiliated):


you can check this website , and also there are videos from pluralsight about windows security but they are a bit outdated ,sans institute also offers a good course and it can be found here , search amazon for this book .NET-Developers-Guide-Windows-Security it is also very useful.


I recommend the Security Now podcast especially if you have some commute time. There is over 400 hours of of security information. For an episode guide and transcripts.

GRC also has some good security tools and info. Is the main site.


These Getting Started Guides might help:


Windows Advanced Firewall: