It's not a big secret at all ;)

tptacek has a list of books on Amazon, linked to from his news.yc profile, which cover a wide range of application security topics (http://amzn.to/cthr46). I own The Art of Software Security Assessment and The Web Application Hacker's Handbook and I can vouch for them as quality resources, although I'm not sure how accessible they would be for a beginner.

In terms of a more practical introduction, Google Gruyere is an application deliberately built with security vulnerabilities for the purposes of learning (http://google-gruyere.appspot.com/). There are plenty of other projects along those lines: WebGoat is another good example.