8

I'm interested in learning about secure system design - the whole stack. Currently, I'm an expert .net/C# developer and I know about the differences between different hash functions, public/private key encryption and similar techniques, but my application is only a small part of the system as a whole.

For example, public/private key encryption isn't simply about the code I write - it's about protecting the private key. I need to give it to clients and they need to keep it save. Then there are other avenues, for example if my web service is secure but someone can just waltz into the database and download all the data, my application's security doesn't matter.

I'm looking into Bruce Schneier's Cryptography Engineering and Applied Cryptography 2nd edition, but these are low level books about the cryptographic algorithms. I need something several layers higher up, something that explains possible attack vectors to be aware of and how to protect against them and mistakes that people commonly make.

I saw a few questions here on Security.SE, but these seemed specific to individual designs or were limited to the Application and not the system as a whole, so I wonder if there is something modern (ideally something that knows about stuff like SHA-3 and "modern" brute force attacks using Cloud or GPU based computing clusters) and authoritative?

closed as too broad by Eric G, Adi, TildalWave, Steve, GdD Mar 21 '14 at 9:17

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

11

If you're looking for non-language/framework specific stuff, you could start with a pair of books on security engineering

Usefully both are available for free online.

If you're looking for more platform specific stuff, if you haven't already I'd recommend looking through Microsofts SDL Documentation

4

A few things from a Secure OS:

https://en.wikipedia.org/wiki/OpenBSD_security_features

Exploit Mitigation Techniques: an Update After 10 Years:

http://www.openbsd.org/papers/ru13-deraadt/
http://tech.yandex.com/events/ruBSD/2013/talks/103/

http://www.openbsd.org/papers/

or: on Youtube: "passwords^12"

1

The best book for learning how to protect web apps is the Web Application Hackers Handbook.

For a general PC based point of view, Hacking: The Art of Exploitation is the best.

1

In addition to the other answers here, I would have a look at the following.

Open Security Architecture CSA CCSK Study

Not the answer you're looking for? Browse other questions tagged or ask your own question.