Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm currently working as a C++ developer in a software security department, but not as a researcher or whitehat hacker. Security is an interest of mine, mainly in the areas where I can exploit code or reverse engineer executables/communication/protocols. I've done some work in reverse engineering but only as a hobby (ie. modifying a saved game file for a game).

As a person that knows C, C++ and some assembly (MASM), what types of resources would you recommend that I read so that I may gain more knowledge about these fields? Books, blogs, and articles would probably be best.

Currently I'm reading 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them.

share|improve this question
add comment

2 Answers

The books that I've always referenced when it comes to software security are Software Security: Building Security In (the Ying-Yang book), Building Secure Software: How to Avoid Security Problems the Right Way (the white hat book), and Exploiting Software: How to Break Code (the black hat book). They are sold as a box set as well.

Regardless of their names and nicknames, all three are valuable to software developers as they put you in different mindsets depending on the software development phase you are currently in. Building Secure Software focuses on designing and developing (or maintaining) a system, with an emphasis on security. Exploiting Software focuses on security testing and the techniques that might be used by an attacker, which is useful when designing and executing security tests. Software Security touches on all aspects of software security.

I also have to recommend the work of Bruce Schneier. I've only read his blog, but he has a number of books that might be relevant as well.

share|improve this answer
add comment

The overall gamut of Security is a very large domain in itself.

I think, based on your description you should try your hands with 2 primary categories

  1. (Understanding and) Implementation of Encryption algorithms and protocols. (Such as PKI).

  2. Software Vulnerability: How Buffer Overflow class of applications and exploits leads to software vulnerability.

These books I think are good references:

  1. Secure Programming Cookbook for C and C++ Recipes for Cryptography, Authentication, Input Validation & More - By John Viega, Matt Messier O'Reilly Media

  2. Writing Secure Code, By Michael Howard, David LeBlanc - Microsoft Press

  3. For all basic concepts: Cryptography and Network Security: Principles and Practice, 3/E by William Stallings Prentice Hall

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.