Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm currently working as a C++ developer in a software security department, but not as a researcher or whitehat hacker. Security is an interest of mine, mainly in the areas where I can exploit code or reverse engineer executables/communication/protocols. I've done some work in reverse engineering but only as a hobby (ie. modifying a saved game file for a game).

As a person that knows C, C++ and some assembly (MASM), what types of resources would you recommend that I read so that I may gain more knowledge about these fields? Books, blogs, and articles would probably be best.

Currently I'm reading 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them.

share|improve this question

closed as off-topic by MichaelT, Bart van Ingen Schenau, Kilian Foth, GlenH7, gnat Aug 12 '14 at 2:46

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to recommend a tool, library or favorite off-site resource are off-topic for Programmers as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it." – MichaelT, Bart van Ingen Schenau, Kilian Foth, GlenH7, gnat
If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

The books that I've always referenced when it comes to software security are Software Security: Building Security In (the Ying-Yang book), Building Secure Software: How to Avoid Security Problems the Right Way (the white hat book), and Exploiting Software: How to Break Code (the black hat book). They are sold as a box set as well.

Regardless of their names and nicknames, all three are valuable to software developers as they put you in different mindsets depending on the software development phase you are currently in. Building Secure Software focuses on designing and developing (or maintaining) a system, with an emphasis on security. Exploiting Software focuses on security testing and the techniques that might be used by an attacker, which is useful when designing and executing security tests. Software Security touches on all aspects of software security.

I also have to recommend the work of Bruce Schneier. I've only read his blog, but he has a number of books that might be relevant as well.

share|improve this answer

The overall gamut of Security is a very large domain in itself.

I think, based on your description you should try your hands with 2 primary categories

  1. (Understanding and) Implementation of Encryption algorithms and protocols. (Such as PKI).

  2. Software Vulnerability: How Buffer Overflow class of applications and exploits leads to software vulnerability.

These books I think are good references:

  1. Secure Programming Cookbook for C and C++ Recipes for Cryptography, Authentication, Input Validation & More - By John Viega, Matt Messier O'Reilly Media

  2. Writing Secure Code, By Michael Howard, David LeBlanc - Microsoft Press

  3. For all basic concepts: Cryptography and Network Security: Principles and Practice, 3/E by William Stallings Prentice Hall

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.