View source

== General Papers and Articles ==

* [http://en.wikipedia.org/wiki/Computer_security Wikipedia on Computer Security] - a good place to start.
* Ross Anderson, [http://www.cl.cam.ac.uk/~rja14/lottery/lottery.html How to Cheat at the Lottery Paper] discussing issues of security design.
* Bruce Schneier, [http://www.schneier.com/crypto-gram-9904.html#different Cryptography: The Importance of Not Being Different] - why not rolling your own security is a good thing.
* [http://www.schneier.com/blog/archives/2008/09/security_roi_1.html Security ROI], Bruce Schneier, September 2, 2008.

== General Books ==
* Ross Anderson, [http://www.amazon.com/exec/obidos/tg/detail/-/0471389226/qid=1128873996/sr=1-1/ref=sr_1_1/104-5414800-5972732?v=glance&s=books Security Engineering] - Good book on design and implementation.
** Now available [http://www.cl.cam.ac.uk/~rja14/book.html online]
** [http://www.amazon.com/Security-Engineering-Building-Dependable-Distributed/dp/0470068523/ref=pd_bbs_sr_2?ie=UTF8&s=books&qid=1209409426&sr=8-2 Second editor] also available.
* Secrets & Lies by Bruce Schneier - Very good book which covers a majority of topics in security.
* Beyond Fear by Bruce Schneier - Covers five steps that should be taken when designing or evaluating security systems. Has many examples outside of computer security which can give interesting insights.
* Bruce Schneier, [http://www.amazon.com/exec/obidos/tg/detail/-/0471117099/qid=1128873790/sr=8-2/ref=pd_bbs_2/104-5414800-5972732?v=glance&s=books&n=507846 Applied Cryptography]  - While heavily oriented towards cryptography, has good basics on design and implementation.
* [http://www.cacr.math.uwaterloo.ca/hac/ Handbook of Applied Cryptography] - Online encyclopedic description of applied modern cryptography.

== Email Lists ==

* Bruce Scheier publishes [http://www.counterpane.com/crypto-gram.html Crypto-Gram], a free monthly email letter that is worth reading.
* [http://www.ieee-security.org/cipher.html IEEE Cipher] is another great monthly letter.

== Tutorials ==
* Dartmouth' s Institute for Security Technology Studies: http://www.ists.dartmouth.edu/cybersecurity-classroom.php
* GIAC Secure Software Programmer (GSSP) Certification Exam: http://www.sans.org/gssp/
* UIUC's FERPA Tutorial: http://www.oar.uiuc.edu/staff/ferpa_tutorial/index.html
* [http://www.cs.washington.edu/education/courses/csep590/06wi/ Practical Aspects of Modern Cryptography], taught by Josh Benaloh, Brian LaMacchia, and John Manferdelli at the University of Washington. The page includes links to lecture notes and video of the classes.

== Important Web Sites ==

* For security news, you should read [http://www.securityfocus.com SecurityFocus News]. I suggest using an RSS reader to keep up2date.
* These sites provide good lists of security related conferences: [http://www.cs.vu.nl/~crispo/security/conf.html Site 1] and [http://www.adastral.ucl.ac.uk/~helger/crypto/link/conferences/2007.php Site 2]

* Computer Forensics, Cybercrime and Steganography Resources. This site has everything forensics, book suggestions, tools, mail lists, links, papers, etc.
**http://www.forensics.nl/

== Web Applications ==

* Know your Enemy: Web Application Threats Using Honeypots to learn about HTTP-based attacks http://www.honeynet.org/papers/webapp/index.html

== NIST Standards ==

* Guide to Secure Web Services: http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf

==Forensics ==

* File System Forensic Analysis by Brian Carrier (author of The Sleuthkit)
** http://www.digital-evidence.org/fsfa/
** http://www.amazon.com/System-Forensic-Analysis-Brian-Carrier/dp/0321268172/ref=pd_sim_b_title_1
* Windows Forensic Analysis by Harlan Carvey
** http://www.amazon.com/Windows-Forensic-Analysis-Including-Toolkit/dp/159749156X
* Digital Investigation
** http://www.sciencedirect.com available from an NCSA/UIUC IP address
** Or you can proxy thru the UI Library Gateway http://www.library.uiuc.edu/proxy/

==Historical==

* [http://www.governmentattic.org/2docs/Hist_US_COMSEC_Boak_NSA_1973.pdf A History of U.S. Communications Security (Volumes I and II); the David G. Boak Lectures], National Security Agency (NSA), 1973
* [http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB260/index.htm National Security Agency Releases History of Cold War Intelligence Activities], NSARCHIVE, November 14, 2008