I don't think anyone gets taught security in CS (seems relegated to informatics or computer engineering programs). Outside of a handful of security researchers

I don't think anyone gets taught security in CS (seems relegated to informatics or computer engineering programs). Outside of a handful of security researchers and those directly working on security products, I don't even know very many senior software engineers that really understand security outside the trivial rules of thumbs. Two books largely on the MS way: "Writing Secure Code: Practical Strategies and Proven Techniques for Building Secure Applications in a Networked World" and "Threat Modeling (Microsoft Professional)" I read both of them years ago when I thought I might take a job in security products at MS, and didn't think much of them. Every developer should have to go back to some of the original IT security papers like Saltzer and Schroeder and think about every way their current framework or design probably compromises a basic principle and whether it is a good thing: http://emergentchaos.com/the-security-principles-of-saltzer-and-schroeder http://emergentchaos.com/the-security-principles-of-saltzer-... Looking at open source software designed for security like postfix can also be quite enlightening.