Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm have good resources on both security, domain modelling, and architecture patterns. I've noticed a distinct lack of any suggestion of how and where to integrate security into the systems I build. I imagine the thing that applies the most is Access control, as Authentications and many other security forms would seem to be obviously a layer above the model and is pretty easy to separate and find a place for. Access Control to actions seems more of a grey area. Are there any good resources on this? I prefer well written books, but other resources are also welcome.

share|improve this question

closed as not constructive by gnat, Walter, Jim G., Dynamic, ChrisF Oct 7 '12 at 11:31

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
it should be noted that I got to maybe chapter 8 or 9 of security engineering before putting it down, so there's some possibility that it covers integration in areas that I've not gotten to. But it seems more a book about theory, concepts and practical problems not code level implementation/integration. –  xenoterracide Oct 3 '12 at 5:58
    
I wish the person who had downvoted my question had left a reason why. –  xenoterracide Oct 3 '12 at 10:22
    
book recommendations are off-topic for P.SE, which is why you picked up a downvote. That having been said, you still have a decent question in here without the book request. Skim over my answer and that should help guide you in tweaking your question to be more on-topic. –  GlenH7 Oct 3 '12 at 11:22

2 Answers 2

I've noticed a distinct lack of any suggestion of how and where to integrate security into the systems I build.

It is quite essential, because security of the system is very high level topic where beginner and intermediate programmers are not interested in. Thus, there is less questions and discussions on the topic.

In my mind, beside authorization and authentication mechanisms, security also should start with Domain design. Thus, it needs to be close to external usages and designed by SOLID principles .

You may also find it interesting to look at IT Security SE discussions.

share|improve this answer

The twins of Authentication and Authorization are the key to your initial questions. Access issues are the glue that bring together the three environments that you mentioned.

From there, secure programming techniques are useful to ascertain that your coding of the domain and other layers will stand up to abuse.

It should be somewhat obvious how architecture patterns and the domain layer dovetail with each other. Security is an omnipresent concern that applies across all of the layers.

Any tomes integrating all three aspects are likely to be dated or irrelevant for your focus. When you multiply the three sets of information (security, domains, architecture) against each other, you can see how it would be impossible to write a single book that adequately covered the topics of interest to everyone.

Keep reading.
Keep coding.
Keep experimenting.
The knowledge you are looking for has to be grown through practice.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.