// What to read next
What to read after Real-World Cryptography
Where to go after Real-World Cryptography, picked from our catalog. The next step up from intermediate level, weighted toward the topics this book covers.
01 · 2024
Serious Cryptography
Jean-Philippe Aumasson's working introduction to modern cryptography, written for engineers who need both intuition and enough mathematical depth to evaluate the choices a library is making for them.
Intermediate5/5Jean-Philippe Aumasson02 · 2010
Cryptography Engineering
A working engineer's introduction to cryptography that takes implementation pitfalls more seriously than most.
Intermediate4/5Niels Ferguson, Bruce Schneier, Tadayoshi Kohno03 · 2020
Security Engineering
Ross Anderson's comprehensive textbook on the design of secure systems, covering protocols, access control, side channels, economics of security, and policy.
Advanced5/5Ross Anderson04 · 2006
The Art of Software Security Assessment
The 1200-page reference on auditing C/C++ codebases for security: parsing complex memory and integer interactions, language pitfalls, and how vulnerabilities arise from interactions between layers.
Advanced5/5Mark Dowd, John McDonald, Justin Schuh05 · 2011
The Tangled Web
The deepest book ever written on the strange, accreted security model of the web browser.
Advanced5/5Michal Zalewski06 · 2005
The Database Hacker's Handbook
Litchfield, Anley, Heasman, and Grindlay's exhaustive 2005 reference on attacking and defending Oracle, SQL Server, DB2, MySQL, PostgreSQL, Sybase, and Informix — the era when the database engine itself was the soft target.
Advanced3/5David Litchfield, Chris Anley, John Heasman, Bill Grindlay07 · 2021
Designing Secure Software
Loren Kohnfelder, the original PKI author, on how to weave security thinking through requirements, design, implementation and operations rather than bolt it on at the end.
Intermediate5/5Loren Kohnfelder08 · 2014
Threat Modeling
Adam Shostack's practitioner-oriented introduction to threat modeling: STRIDE, attack trees, and how to fit the practice into a real software-development lifecycle.
Intermediate5/5Adam Shostack