As a web developer, this would be a good place to start: http://www.owasp.org/index.php/Main_Page
Systems-level security programming is outside of my domain. Anyone want to chime in?
Systems-level security programming is outside of my domain. Anyone want to chime in?
Level 2^n: uses string concatenation in his SQL, for web forms passes plaintext passwords around in Javascript, has already been rooted and doesn't know it.
Level n^2: uses stored procedures, knows that cross site scripting and sql injection is bad, stores passwords in a form other than plain text, may block certain kinds of 'naughty' inputs (e.g. http://xkcd.com/327/ )
Level n: uses whitelists to validate input, does not use windows or SQL Server for anything, understands that security has a price (eternal vigilance) can explain what salting and hashing are, can protect your password against malicious database admin.
Level log(n): can protect against social engineering, audits OpenBSD for jollies, has transcended the need for users to create accounts and enter passwords, is completely unable to communicate with outside world since all their email has been PGP encrypted since the late 90s.
Level n: as much as I dislike it, Windows' security isn't actually all that bad nowadays. This, of course, assumes that you don't ever start IE, install no Adobe products, configure it properly, etc - but that's common sense for a server. Also, "eternal vigilance"? I think you need one patch to make a five-year old OpenBSD server as secure as pretty much any other system out there.
Level log(n): again, you can be pretty secure without being completely useless. Should include HMAC and PBKDF2/OpenBSD's Blowfish scheme/scrypt. May include full-disk encryption.
I do however stand 100% behind the eternal vigilance comment.
I wasn't expecting an example so quickly, but this serves as a case in point:
Anyone who is half sensible won't be doing either of these so I'm not sure what it proves.