Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm interested in learning about secure system design - the whole stack. Currently, I'm an expert .net/C# developer and I know about the differences between different hash functions, public/private key encryption and similar techniques, but my application is only a small part of the system as a whole.

For example, public/private key encryption isn't simply about the code I write - it's about protecting the private key. I need to give it to clients and they need to keep it save. Then there are other avenues, for example if my web service is secure but someone can just waltz into the database and download all the data, my application's security doesn't matter.

I'm looking into Bruce Schneier's Cryptography Engineering and Applied Cryptography 2nd edition, but these are low level books about the cryptographic algorithms. I need something several layers higher up, something that explains possible attack vectors to be aware of and how to protect against them and mistakes that people commonly make.

I saw a few questions here on Security.SE, but these seemed specific to individual designs or were limited to the Application and not the system as a whole, so I wonder if there is something modern (ideally something that knows about stuff like SHA-3 and "modern" brute force attacks using Cloud or GPU based computing clusters) and authoritative?

share|improve this question

closed as too broad by Eric G, Adi, TildalWave, Steve, GdD Mar 21 '14 at 9:17

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

If you're looking for non-language/framework specific stuff, you could start with a pair of books on security engineering

Usefully both are available for free online.

If you're looking for more platform specific stuff, if you haven't already I'd recommend looking through Microsofts SDL Documentation

share|improve this answer

A few things from a Secure OS:

Exploit Mitigation Techniques: an Update After 10 Years:

or: on Youtube: "passwords^12"

share|improve this answer

The best book for learning how to protect web apps is the Web Application Hackers Handbook.

For a general PC based point of view, Hacking: The Art of Exploitation is the best.

share|improve this answer

In addition to the other answers here, I would have a look at the following.

Open Security Architecture CSA CCSK Study

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.