Product Security

The following resources are highly recommended to all product security professionals.

Discussions

• OWASP Slack

Newsletters

• TL;DR Sec
• Feisty Duck Cryptography & Security
• Python Weekly

Conferences

• FIRST
• Usenix
• OWASP Global AppSec EU/USA
• Sec-T

Software Architecture

• Engineering secure devices (no starch press)
• Do developers update their library dependencies?
• Secure By Design at Google
• Why Don't Developers Detect Improper Input Validation?'; DROP TABLE Papers; --
• An SRE guide to Linux Kernel upgrades

Threat Modeling

• Threat modeling - designing for security (wiley)
• Threat modeling (O'reilly)
• “Threat modeling is very formal, it’s very technical, and also very hard to do correctly”: Investigating Threat Modeling Practices in Open-Source Software Projects

Cryptography

• Serious cryptography (no starch press)
• Real-World cryptography (manning)
• Secret key cryptography (manning)