Organizations

• IETF의 application 보안 관련 표준, Future System 정리
• ASRG, Anti-Spam Research Group of the Internet Research Task Force (IRTF)
• TrustedSource(Statistics for SPAM).
• DNSSEC projects, RFC's, drafts, articles, howto's and presentations.
• IMC(Internet Mail Consortium)
  • S/MIME and OpenPGP
• MIT Distribution Center for PGP
• OWASP(The Open Web Application Security Project)
• WASC(Web Application Security Consortium)
• ISECOM, Institute for Security and Open Methologies
  • OSSTMM, Open Source Security Testing Methodology Manual ISECOM, February 26, 2002. (local copy)
• CIS, Center for Internet Security
• AVDL, Application Vulnerability Description Language
• OSVDB, The Open Source Vulnerability Database
• NVD, The National Vulnerability Database
• TCG, The Trusted Computing Group
• TECF, The Trusted Electronic Communications Forum
• Security Forum, An excellent all around security and computing portal aimed at the discussion and awareness of computer security. Includes areas for cryptography, firewalls, intrusion detection, Windows and much more.
• Cryptography Research
• ICAP Forum, Internet Content Adaptation Protocol.
• CGI Security
• AppSic, The Application Security Industry Consortium.
• PCI-SVA, Payment Card Industry (PCI) Security Vendor Alliance (SVA).

Resources

• INFS 766: INTERNET SECURITY PROTOCOLS(lecture), Spring 2002
• W3C Security Resources, W3C.org
• Aspect security's resources, Web security Specialist.
• DevEdge Online - Netscape Developer site, Netscape
• Netscape Security Notes, Netscape
• IMP Web Mail Solution, Horde.org
• ETC, E-Mail Technology Conference
• Application-level Security Products, Esecurityplanet
• Web Application Security, Security PS
• Packet Storm
• GFI Security software's Whitepaper
• Anti-spam buyer's guide
  - Anti-spam Pricing and features (local copy)

• Watermarking World - Webring
• DataHidingTM / Rights Management - related to watermarking
• Mozilla Security Projects, Mozilla.org
  • Component Security for Mozilla, Mozilla.org
  
  
• Java Developer Connection, Sun Microsystems
• Java Security, Sun Microsystems - Java Security API, News, Software, Documentation, User Guides, Man pages, FAQ, Whitepapers, Articles, Presentation
  • JavaTM Security Architecture (JDK1.2), Lee Gong, October 2, 1998
  • JavaTM Cryptography Architecture, Dec, 6, 1999
  • Summary of JDK 1.2 Security Tools, Oct, 19, 1998
• IBM JAVA Research section, IBM
• Java Security Resources, JavaWorld
• Java Security related Articles, Java World

• Microsoft Security, Microsoft
  • Web Site Security, Microsoft
  • Security Bulletin and Search, Microsoft
• Exchange Server/Email Security, Microsoft

• The International PGP Home Page
  • PGP documentation
  • Download
• Tom McCune's page for Pretty Good Privacy(PGP)
• The PGP4Pine homepage

• SSH: The Secure Shell, The Definitive Guite
• FreeSSH - SSH Product Client / Server Links
• OpenSSH - Free SSH Server/Client Implemenation

• GNU TLS Library
• Netscape SSL Page, Netscape
• OpenSSL - Free SSL / TLS Implementation
• SSL Resource Center, Phaos Technology Corporation
• Apache-SSL - Apache-SSL is a secure Webserver, based on Apache and SSLeay/OpenSSL.
• modSSL - The Apache Interface to OpenSSL
• SSL Accelerators(November 1, 2002), Network Computing's Interactive Buyer's Guide

Papers and Articles

[Web]

• Basic Security Profile Version 1.0, Final Material, WS-I(The Web Services-Interoperability Organization), March 30, 2007. (local copy)
• 9 Critical Requirements for Web Application Security, Citrix, July 2006. (local copy)
• The Web Application Firewall Evaluation Criteria v1.0, The Web Application Security Consortium, January 16, 2006 (local copy)
• The Powerful Technologies Behind Best-of-Breed Internet Filtering, St Bernard, July 2005. (local copy)
• Filtering the Spectrum of Internet Threats: Defending Against Inappropriate Content, Spyware, IM, and P2P at the Perimeter, St Bernard, 2005. (local copy)
• Fighting The Hidden Dangers Of Internet Access, St Bernard, 2005. (local copy)
• E-Policy Best Practices A Business Guide to Compliant & Secure Internet, Instant Messaging (IM), Peer-to-Peer (P2P) and Email Communications, St Bernard, 2005. (local copy)
• Application Firewalls: Don't Forget About Layer 7, SANS Reading Room, Russell Eubanks, May 17, 2005. (local copy)
• Security Challenges, Threats and Countermeasures Version 1.0, Final Material, WS-I(The Web Services-Interoperability Organization), May 7, 2005. (local copy)
  - Security Challenges, Threats and Countermeasures 1.0 Errata, WS-I Working Group Draft, Revision: 1.0, August 14, 2006.
• Web application defense at the gates ? Leveraging IHttpModule, Shreeraj Shah, SecurityWriter, March 2005. (local copy)
• HTTP Response Splitting, Amit Klein, Sanctum, Inc., March 24, 2005. (local copy)
• A Guide to Discovering Web Application Insecurities, Before Attackers Do, Don Williams, SANS Reading Rooms, March 2005. (local copy)
• Document Security in Web Applications, Andres Desa, SecurityWriter, February 03, 2005. (local copy)
• Web Application Security For All, Andrew Conry-Murray, Networkmagazine, February 01, 2005.
• The 80/20 Rule for Web Application Security(Version 1.8), Jeremiah Grossman, Webappsec, January 31, 2005.
• Threat Modeling: A Process To Ensure Application Security, SANS Reading Room, Steven Burns, January 5, 2005. (local copy)
• Thick Client Application Security, Arindam Mandal, Paladion Networks, January 2005. (local copy)
• Web Application Attacks: New Threats and Countermeasures, David Jevans, Senior Vice President, Teros, January 2005. (local copy)
• Authentication and Session Management on the Web, Paul Johnston, SANS Reading Room, November 28, 2004. (local copy)
• Trends in Web Application Security, Kapil Raina, CISSP, SecurityFocus, October 27, 2004.
• The Twenty Most Critical Internet Security Vulnerabilities, Version 5.0, SANS Institute, October 8, 2004. (local copy)
  - Version 4.0, SANS, October 8, 2003.
  -Presentations : Top 20 Presentation, Top 20 Overview, CDI SANS@Night Top 20 Presentation
  - 한글판
• Developing and Deploying Secure Web Applications, Watchfire, October 1, 2004. (local copy)
• Market Analysis: Web Application Delivery-Challenges and Solutions Summary, The Strategy Group on behalf of Redline Networks, October 2004. (local copy)
• Data Driven Attacks Using HTTP Tunneling, Ido Dubrawsky, August 2, 2004.
• Why Application Security Is the New Business Imperative - And How to Achieve It : Business Accountability Demands a Process-Oriented Approach to Fixing Security Flaws in Software Secure Software, August 1, 2004. (local copy)
• Web Security Threat Classification(Version 1.00), Web Application Security Consortium, July 2004. (local copy)
• Technology Insider: Web application security, Network World, May 17, 2004.
  - All-out blitz against Web app attacks, Paul Desmond.
  - Quick tips for Web application security, Thomas Powell.
  - Application firewall appliances: Defending servers from HTTP-based attacks, Thomas Powell.
• Security at the Next Level: Are Your Web Applications Vulnerable?, SPI Dynamics, May 1, 2004. (local copy)
• Basic Web Session Impersonation, Rohyt Belani, SecurityFocus, April 14, 2004.
• Large Enterprise Application Security, Dave Aitel, Immunity, Inc., April 5, 2004. (local copy)
• The Proxy Appliance: Guardian for Your Web Users, Blue Coat Systems, Inc., April 1, 2004. (local copy)
• Assessing Vendor Application Security A Practical Way to Begin, Barton Hubbs, SANS Reading Room, February 17, 2004. (local copy)
• The Art of Web Filtering, Robert Alvey, SANS Reading Room, February 9, 2004. (local copy)
• The Ten most Critical Wev Application Security Vulnerabilities(2004 update), OWASP(The Open Web Application Security Project), January 27, 2004. (local copy)
  - Version of 2003, January 13, 2003. (local copy)
• Tips and Tricks: Web Services Attacks and Defenses, Reactivity, January 1, 2004. (local copy)
• Managing Risk and Reducing the Cost of Web Application Security, SPI Dynamics, January 1, 2004 (local copy)
• Core Security, Vormetric, November 1, 2003. (local copy)
• Web Security Appliance With Apache and mod_security, Ivan Ristic, SecurityFocus, October 21, 2003.
• NetTracker® Log File Analysis vs. Page Tagging: A Guide for Comparing Web Analytics Methodologies, Sane Solutions, LLC., October 1, 2003. (local copy)
• Securing Your Business: Costly Threats to Web Sites - Speedera's Secure Solutions, Speedera Networks, October 1, 2003. (local copy)
• HTTP Tunnels Though Proxies, Daniel Alman, SANS Reading Room, September 9, 2003. (local copy)
• Application Security: Attackers Won’t Stop at the Firewall (Why should you?)(PowerPoint), Kenneth Newman, HelpNEt-Security, August 31, 2003. (local copy)
• Demonstrating ROI for Penetration Testing, Part 3, Marcia J. Wilson, SecurityFocus, September 11, 2003.
• Penetration Testing for Web Applications, Part 2, Jody Melbourne and David Jorm, SecurityFocus, July 3, 2003.
• Penetration Testing for Web Applications, paer 1, Jody Melbourne and David Jorm, SecurityFocus, June 16, 2003.
• Exploitation of data streams authorized by a network access control system for arbitrary data transfers: tunneling and covert channels over the HTTP protocol, Alex Dyatlov and Simon Castro, Gray-world.net, June 2003. (local copy)
• Application Security and the Application Network, Permeo Technologies, Inc., May 23, 2003. (local copy)
• Blocking attacks on applications, Abhishek Chauhan, SCmagazone, May 2003.
• Compass Security Finjan SurfinGate Analysis, Ivan Buetler, Compass Security AG, January 31, 2003. (local copy)
• Plug, Play, and Protect: Putting Security Software into Appliances, IDC provided by Network Engines, January 1, 2003. (local copy)
• Assessing the Need for Application Security Gateways, Permeo Technologies, Inc., January 1, 2003. (local copy)
• Application Security Business White Paper, Permeo Technologies, Inc., January 1, 2003. (local copy)
• Top Ten Ways to Improve Your Website, Global Knowledge, January 1, 2003. (local copy)
• The First 15 Minutes: Critical Technical Considerations for Defending Enterprise Networks against the Next Wave of Internet Threats, ForeScout Technologies, Inc., December 1, 2002. (local copy)
• Session Fixation Vulnerability in Web-based Applications, Mitja Kolsek, Acros Security, December 2002. (local copy)
• Designing a Digital Security Framework, Interdimensions, December 2002. (local copy)
• Dynamic Filtering of Internet Content: An Overview of Next Generation Filtering Technology, iCognito Ltd., November 1, 2002. (local copy)
• Mask Your Web Server for Enhanced Security, Joe Lima, Port80software, November 2002.
• Securing End Users from Attack, Andrew Conry-Murray, NetworkMagazine, October 5, 2002.
• Application security - the weakest link, Itay Haber, SCmagazine, October 2002.
• A Guide to Building Secure Web Applications and Web Services(Version 1.1), OWASP(The Open Web Application Security Project), September 22, 2002. (local copy)
• Appropriate Use of Network Encryption Technologies, Kenneth Forward, SANS, September 20, 2002.
• HTTP Compression Technology Overview, Redline Networks, September 1, 2002. (local copy)
• 10 Questions to Ask about Web Acceleration Solutions, Redline Networks, September 1, 2002. (local copy)
• XTND Connect Server: Security, Extended Systems, August 2002. (local copy)
• Active Application Security Solutions, Ingrian Networks, Inc., August 1, 2002. (local copy)
• Infranet: Circumventing Web Censorship and Surveillance, Nick Feamster, Magdalena Balazinska, Greg Harfst, Hari Balakrishnan, David Karger, MIT Laboratory for Computer Science, USENIX 2002. (local copy)
• What to Look for in a Web Application Protection System, Abishek Chauhan, SCmagazine, July 2002.
• Security in Plan 9, Russ Cox, Eric Grosse, Rob Pike, Dave Presotto, Sean Quinlan, Securityfocus, 2002. (local copy)
• Astaro Content Filtering Process, Astaro Internet Security, May 2002. (local copy)
• An Introduction to Network Security in Embedded Devices, Wind River Systems, May 31, 2002. (local copy)
• Bulletproof, Mike Bobbitt, Information Security, May 3, 2002.
  - Different Approaches, Same Goal,
  - The Attacker's Arsenal
• Content Security for the Enterprise, Authentica Inc., Whitepaper, April 2, 2002. (local copy)
• The Internet Security, Jappila, P.& Poyhonen P., March 13, 2002. (local copy)
• Statistical Identifcation of Encrypted Web Browsing Traffic, Venkata N. Padmanabhan, Lili Qiu, Wilf Russell, Daniel R. Simon, Qixiang Sun & Yi-Min Wang, MS Technical Report, March 2002. (local copy)
• Collaborative Filtering with Privacy, John Canny, UC Berkely, 2002. (local copy)
• Collaborative Filtering with Privacy via Factor Analysis, John Canny, UC Berkely, 2002. (local copy)
• P5: A Protocol for Scalable Anonymous Communication, Bobby Bhattacharjee, Rob Sherwood & Aravind Srinivasan, University of Meryland, 2002. (local copy)
• J2EE and .Net security, Ger Mulcahy, SecurityFocus, February 2002. (local copy)
• The changing face of web security, ArticSoft, 2002. (local copy)
• Countering Threats to Content Security: A Proactive Approach, FutureSoft, Inc., January 1, 2002. (local copy)
• Preventing Web Site Defacements, Ryan C. Barnett, SecurityFocus, 2001 (local copy)
• Microsoft .Net strategy pushes the Web application development envelope, Arthur English, NetworkWorld, November 05, 2001.
• Web services can simplify Web apps, David Weller, NetworkWorld, November 05, 2001.
• Brute-Forcing Exploitation of Web Application Session IDs, David Endler, IDefense Labs, November 01, 2001. (local copy)
• Companies At Risk Over Proliferation Of Web Bugs, InternetWeek, August 14, 2001.
• Hardening HTAccess, Part Three, Security Focus, August 6, 2001.
• Hardening HTAccess, Part Two , Security Focus, July 25, 2001.
• Hardening HTAccess, Part One , Security Focus, July 11, 2001.
• Webjacking, Lexis-Nexis, July 2001.
• The Web-Bug Boondoggle, InformationWeek, June 25, 2001.
• Examining Web Content Security Software, Curtis Franklin Jr., Planet IT, March 13, 2001
• Report: Many federal Web sites use cookies to track users, Lucas Mearian, Computer World, April 17, 2001.
• Taking the Web Server Down when the Firewall is Sound , VIGILANTe.com, 2001
• Web Spoofing : An Internet Con Game, Edward W. Felten, Dirk Balfanz, Drew Dean, and Dan S. Wallach at Department of Computer Science, Princeton University
• Examining Web Content Security Software, Curtis Franklin Jr., PlanetIT, Mar, 13 2001
• Securing your IIS 4.0 server, Troy Thompson, TechRepublic, Jan 24, 2001 ( You must create your Free account )
• Best Practices for Secure Web Development, Razvan Peteanu, July 18, 2000 (local copy)
• Secure Internet Information Services 5 Checklist , Microsoft, June 29, 2000
• Microsoft Internet Information Server 4.0 Security Checklist, Microsoft, Mar. 15,2000
• Web server round-up, part 2, Kurt Seifried, Security Portal, December 12, 1999.
• Web server round-up, part 1, availability, Kurt Seifried, Security Portal, November 10, 1999.
  
  
• Web security, Geoff Marshall, SCmagazine, August 2003.
• Emerging Technology: Protect Web Applications from Abuse and Misuse, Andrew Conry-Murray, Network Magazine, July 07, 2003.
• Proxies Add a Protective Shield, Jeff Forristal, NetworkComputing, March 5, 2003. (local copy)
• Internet security, Craig Hinton, SCmagazine, March 2003.
• Wide Open on Port 80, Kelly White and Yong-Gon Chon, InformationSecurity, January 2003.
  - Open for Business, Open to Attack, Kelly White and Yong-Gon Chon, InformationSecurity, January 2003.
  - Testing for Failure: New tools ease the burden of building secure code, Pete Lindstrom, InformationSecurity, January 2003.
  
  
• HTML Form Protocol Attack(Ver 1.0), Jochen Topf, Remote.org, August 14, 2001. (local copy)
• Proxy-Based Security Protocols in Networked Mobile Devices, M. Burnside, D. Clarke, T. Mills, A. Maywah, S. Devadas, R. Rivest, MIT Laboratory for Computer Science, 2002. (local copy)
• SNMP Defense Strategies: Defending Your Network from SNMP Attacks, SecureWorks, July 18, 2002.
• Understanding MS Proxy Server 2.0, CYDONIA, EBCVG, November 10, 2002.
• The Next Internet Privacy in Internet Protocol Version 6 (IPv6), Kevin Scott, SANS Reading Room, March 24, 2004. (local copy)
• A day in the life of the JPEG Vulnerability, Charles Hornat, SecurityWriter, October 10, 2004. (local copy)
  
  
• Security for Web Database Applications, John Paul Ashenfelter, April 13, 2001
• Encryption of Data at Rest(Database Encryption Whitepaper), Application Security, 2001. (local copy)
• Violating Database - Enforced Security Mechanisms, Chris Anley, An NGSSoftware Insight Security Research Publication, June 18, 2002. (local copy)
• Protecting Oracle Databases, Application Security, Inc., April 1, 2003. (local copy)
• Protecting Databases, Application Security, Inc., September 6, 2003. (local copy)
• Guide to the Secure Configuration and Administration of Oracle9i Database Server, NSA Security Recommendation Guides, September 30, 2003. (local copy)
• Oracle Row Level Security: Part 1, Pete Finnigan, SecurityFocus, November 7, 2003.
• Oracle Row Level Security: Part 2, Pete Finnigan, SecurityFocus, November 17, 2003.
• Time is Right for Database Encryption, Don MacVittie, NetworkComputing, December 9, 2003.
• Hackproofing DB2, Aaron C. Newman, Application Security, December 2003. (local copy)
• Oracle Database Listener Security Guide, Stephen Kost, HelpNet-Security, January 20, 2004. (local copy)
• Database Security: A Key Component of Application Security, Application Security, Inc., May 10, 2004. (local copy)
• Defending OS Vulnerabilities in an Oracle Environment, Vormetric, Inc., July 1, 2004. (local copy)
• A Database Encryption Solution That Is Protecting Against External And Internal Threats, And Meeting Regulatory Requirements, Ulf Mattsson, HelpNet-Security, July 28, 2004. (local copy)
• Data Integrity? The Unknown Threat, Dwayne Melancon, EBCVG, July 30, 2004.
• Securing Enterprise Databases: Protecting against External and Internal Threats - A Buyer's Guide, Protegrity, Inc., September 1, 2004. (local copy)
• Enforcing Data Privacy Protection in an Oracle Database Environment, Vormetric, Inc., October 19, 2004. (local copy)
• Special Report: Database Security, SecurityPipeline, Fred Cohen, December 22, 2004.
• Providing Database Encryption as a Scalable Enterprise Infrastructure Service - Protecting Against External and Internal Threats, Ulf T. Mattsson, HelpNet-Security, February 16, 2005. (local copy)
• What is the point of encryption if you don’t know who for?, Comodo Inc., Dr. Colin Walter, April 2005. (local copy)
  
  
• Digital Watermarking: A Technology Overview, Wipro Technologies, January 1, 2001. (local copy)
• A Review of the Diffie-Hellman Algorithm and its Use in Secure Internet Protocols, David A. Carts, SANS, November 5, 2001.
• Basic Cryptanalysis Techniques, Craig Smith, SANS, November 17, 2001.
• Types and Effects for Asymmetric Cryptographic Protocols, Andrew D. Gordon & Alan Jeffrey, January 28, 2002. (local copy)
• Introduction to cryptography, Pierre Loidreau, Linuxfocus, May 15, 2002.
• Unlocking the Secrets of Crypto: Cryptography, Encryption, and Cryptology Explained, Sarah Granger, August 13, 2002.
• Exploring Diffie-Hellman Encryption, Jack Dennon, Linuxjournal, August 16, 2002.
• Prime Number Hide-and-Seek: How the RSA Cipher Works, Brian Raiter, Muppetlabs, August 2002.
• A Web-only Primer on Public-key Encryption, Charles C. Mann, Theatlantic, September 2002.
• The Best Free (and Cheap) Security Software Part 1: Hashes and Encryption, Ric Steinberger, SCmagazine, September 2002.
• Quantum Cryptography, Caboom, SecurityWriters.org, September 04, 2002.
• Basics of Cryptography, Luser, SecurityWriters, September 04, 2002.
• Cryptographic Terminology 101, Dru Lavigne, Onlamp, October 31, 2002.
• Explaining encryption ArticSoft, November 15, 2002. (local copy)
• Algorithm Alphabet Soup Rick Smith, InformationSecurity, January 2003.
• Remote Administration Software Attacks on Systems Using Public Key Security with and without Smart Cards Datakey, January 1, 2003. (local copy)
• Exploring RSA Encryption Jack Dennon, Linuxjournal, March 06, 2003.
• Steganography Revealed Kristy Westphal, SecurityFocus, April 9, 2003.
• Perfectly Secure Key Management System Using Quantum Key Distribution MagiQ Technologies, Inc., January 1, 2003. (local copy)
• Key Iterations and Cryptographic Salts Adam Berent, HelpNet-Security, May 26, 2003. (local copy)
• Why We May Never Have DRM Hagai Bar-El, 2003. (local copy)
• Advanced Encryption Standard Simplified Adam Berent, July 2003. (local copy)
• Demystifying DSS: The Digital Signature Standard Richard Brehove, SANS Reading Room, August 22, 2003. (local copy)
• Cryptography - Business Value Behind the Myth Jeff Christianson, SANS Reading Room, August 25, 2003. (local copy)
• DRM: A Question Of Balance, Andrew Conry-Murray, Networkmagazine, December 05, 2003.
• Digital Signatures And European Laws, Mirella Mazzeo, SecurityFocus, January 12, 2004.
• Password Based Cryptography, Adam Berent, ABI Software, February 2004. (local copy)
• Security Through Obscurity, K.Duraiswamy & R.Uma Rani, SecurityWriter, June 20, 2004. (local copy)
• How to use cryptography in computer security, Arvind Narayanan, ITmanagersJournal, June 24, 2004.
• Securing Key Distribution with Quantum Cryptography, Bradford Bartlett, SANS Reading Room, June 30, 2004. (local copy)
• A Study Of Steganography And The Art Of Hiding Information, Alain Brainos, SecurityWriter, July 27, 2004. (local copy)
• An Illustrated Guide to Cryptographic Hashes, Steve Friedl, Unixwiz.net, 2004.
• Defeating Encryption, John Bambenek, SecurityWriter, November 22, 2004. (local copy)
• Quantum key distribution, Jennifer Ouellette, American Industitute of Physics, December 2004. (local copy)
• An Illustrated Guide to Cryptographic Hashes : Steve Friedl's Unixwiz.net Tech Tips, Unixwiz.net, March 2005.
• Why Document DRM will Replace Encryption as the Standard for Document Protection, Dr. Stephen Hitchen, SecurityWriter, March 2005. (local copy)
  
  
• Security: Essential For Wireless and Wireline Communications, Digital Network Architects Ltd., 2000. (local copy)
• The Internet is Not Falling!, Rik Farrow, NetworkMagazine, October 6, 2003.
• Route to Security, MERIKE KAEO, InfosecurityMagazine, March 2004.
  - Router Security 101
• Next-Generation Desktop Security Defends Against New Threats, Andrew Conry-Murray, Network Magazine, March 1, 2005.
  - The Battle For The Desktop Rages On, Andrew Conry-Murray, Network Magazine, March 01, 2005.
• Router Security Configuration Guide(Version 1.1c), NSA Security Recommendation Guides, December 15, 2005. (local copy)
  - Router Security Configuration Guide-Executive Summary, February 10, 2003. (local copy)
  - Old version, December 10, 2002. (local copy)
• Router Security Configuration Guide Supplement - Security for IPv6 Routers, NSA Security Recommendation Guides, May 23, 2006. (local copy)
  
  
• Digital Signatures and PKCS#11 Smart Cards: Concepts, Issues and some Programming Details, Rekesh John & Rajesh Parikh, California Software Labs, April 2000.
• An Overview of Hardware Security Modules, Jim Attridge, SANS, January 14, 2002.
• Secrecy in Multiagent Systems, Joseph Halpern & Kevin O'Neill, 2002. (local copy)
• Keeping Secrets in Hardware: the Microsoft XBox Case Study, Andrew "bunnie" Huang, Massachusetts institute of technology, May 26, 2002. (local copy)
• Cyclone: A Safe Dialect of C, Trevor Jim, Greg Morrisett, Dan Grossman, Michael Hicks, James Cheney and Yanling Wang, 2002. (local copy)
• Simplified Hardware Design, QLogic Corporation, June 2002. (local copy)
• Network Processors, Samuel J. Barnett and Mark R. Fauber, Integrated Communications Design, September 2002.
• MIDP Application Security 1: Design Concerns and Cryptography, Sun Microsystems, September 1, 2002.
• Successfully Using Linux and Open Software in an Embedded System Design, LynuxWorks, Inc., August 2002.
• Security Implications of Hardware vs. Software Cryptographic Modules, Discretix Technologies, September 30, 2002. (local copy)
• Linux In Embedded Systems: Where Are The Benefits?, Wind River Systems, October 2002. (local copy)
• x86-64 Technology White Paper, AMD (Advanced Micro Devices, Inc.), October 2002. (local copy)
• Embedded Networking Systems From Theory to Practice, RADLAN Computer Communications Ltd., December 1, 2002. (local copy)
• Secure Programming for Linux and Unix HOWTO(v3.005), David A. Wheeler, Dwheeler, December 30, 2002.
• Layered Network Security: A best-practices approach, StillSecure, January 2003. (local copy)
• The Advantages of Block-Based Protocol Analysis for Security Testing, Dave Aitel, Immunity Inc., February 4, 2003. (local copy)
• Decimalisation Table Attacks for PIN Cracking, Mike Bond and Piotr Zielinski, University of Cambridge, February 20, 2003. (local copy, local copy)
• Cryptographic Filesystems-Part One: Design and Implementation, Ido Dubrawsky, SecurityFocus, March 7, 2003.
• Cryptographic Filesystems-Part Two: Implementation, Ido Dubrawsky, SecurityFocus, April 11, 2003.
• Use Cipher for robust command line encryption of client data, Deb Shinder, TechRepublic, March 19, 2003.
• Encryption of text in bmp-simplest algorithm, Anthraxx, BCVG, March 23, 2003.
• C Programming Tutorial NrAziz, BCVG, March 23, 2003.
• The AMD64 ISA Value Proposition, AMD (Advanced Micro Devices, Inc.), April 2003. (local copy)
• Socket Programming in C, Polygrithm, BCVG, April 11, 2003.
• Secure Programming Techniques, Part 4, Gene Spafford, Simson Garfinkel and Alan Schwartz, Onlamp, May 2003.
  - Secure Programming Techniques, Part 3
  - Secure Programming Techniques, Part 2
  - Secure Programming Techniques
• An overview of common programming security vulnerabilities and possible solutions, Yves Younan, SecurityFocus, August 2003. (local copy)
• Secure Coding: Principles & Practices - Sample chapter 1 "No Straight Thing", Robert Buljevic, HelpNet-Security, October 17, 2003. (local copy)
• On the Importance of Secure Coding, Hagai Bar-El, December 2003. (local copy)
• Secure Coding Principles 101, Intranet Journal, January 20, 2004.
• Elliptic Curve Cryptography and Smart Cards, Ahmad Kayali, SANS Reading Room, February 17, 2004. (local copy)
• Secure Development Framework, Corsaire, Glyn Geoghegan, April 5, 2004. (local copy)
• An intro to Elliptical Curve Cryptography, DeviceForge, July 20, 2004.
  
  [CGI Security]
  
• CGI Security Tutorial, Genrep, 1996
• CGI Security : Better Safe than Sorry, Pankaj Kamthan, 1999
• CGI Security Compilation, Markus Hubner
• CGI security: Avoiding common pitfalls, Kevin Paulisse, 1999
• Server Side Includes and CGI Security, Jason Nugent, 1999
• Security Issues When Installing and Customizing Pre-Built Web Scripts, Selena Sol, 1998
• CGI-script security 101, Andrew Wild
• CGI Vulnerabilities, Aleksandar Stancin, Help Net Security, 2001.
• Header Based Exploitation: Web Statistical Software Threats, Zenomorph, CGIsecurity, January 2002.
  
  [PHP Security]
  
• Securing PHP, Mike Peters, Linux, August 12, 2004.
• Securing PHP: Step-by-step, Artur Maj, SecurityFocus, June 23, 2003.
• Ten Security Checks for PHP, Part 1, Clancy Malcolm, Onlamp, March 20, 2003.
• CASR - ACAT: PHP TopSites Vulnerability Report, CyberArmy, SecurityWriters, March 15, 2003.
• Programming PHP with Security in Mind, Nuno Loureiro, LinuxJournal, October 01, 2002.
• Exploiting Common Vulnerabilities in PHP Applications: A reprint of reminisces from the Blackhat Briefings Asia 2001, Shaun Clowes, SecureReality, September 2002. (local copy)
• Securing Servers With PHP, PHPwizard, Jim Barcelona, February 4, 2002.
• On the Security of PHP, Part 2, Jordan Dimov, Earthweb, November 14, 2001.
• On the Security of PHP, Part 1, Jordan Dimov, Earthweb, November 09, 2001.
• Using PHP Securely, SecuriTeam, July 04, 2001.
• Understanding functions and classes in PHP, Shelley Doll, TechRepublic, July 2, 2001.
• Tutorial: Getting started with PHP, Shelley Doll, TechRepublic, May 7, 2001.
• PHP Manual : Security, The PHP Development Team, 2000
  
  [Java Security]
  
• Working with Java security features, Lotus.com.
• Archives of java-security@sun.com, Sun Microsystems
• A Comparison between Java and ActiveX Security, David Hopwood , Oct, 1997
• Java security: How to install the security manager and customize your security policy , Bill Venners, Java World, Nov, 1997
• The Java Security Web Site, Gary McGraw and Edward Felten, 1999
• Java security evolution and concepts, Part 3: Applet security, Raghavan N. Srinivas, Java World, Dec, 2000
• JavaScript Security in Mozilla, Mozilla.org, 2001
• Securing Java Code, Thomas Gutschmidt, Software Development
  • Part 1, April 12, 2001.
  • Part 2, May 1, 2001.
  • Part 3, May 17, 2001.
  • Part 4 : Decompilers, June 12, 2001.
• Java technology trends through 2004, M. Driver, TechRepublic, August 08, 2001.
• JSP Security, Jordan Dimov, September 13, 2001.
• Stack Inspection: Theory and Variants, C´edric Fournet & Andrew D. Gordon, Microsoft Research, 2002. (local copy)
• Component Security Design Considerations for J2EE and .Net-An Architectural View, Gunnar Peterson, Information Security Bulletin, May 2002.
  - Part 1(local copy)
  - Part 2(local copy)
  - Part 3(local copy)
• All that JAAS: Scalable Java security with JAAS, John Musser and Paul Feuer, Javaworld, September 13, 2002.
• Using AES with Java Technology, Rags Srinivas, Developer, June 2003.
• Using Digital Signatures and Certificates in Java, Svetlin Nakov, Developer, November 2003.
• Guide to Sun Microsystems Java Plug-in Security, NSA Security Configuration Guide, DEcember 8, 2003. (local copy)
  
  [Browser Security]
  
• Securing Your Web Browser, CERT/CC, January 23, 2006.
• Web Browser Insecurity, SANS Reading Room, Paul Asadoorian, June 2, 2005. (local copy)
• Cryptosystems That Secure Web Browsers, Craig Luther, SecurityWriter, July 2004.
• Guide to Securing Netscape Navigator 7.02, NSA Security Recommendation Guide, June 24, 2003. (local copy)
• Guide to Securing Netscape Navigator 7.0, NSA Security Recommendation Guide, February 10, 2003. (local copy)
• Guide to Securing Microsoft Internet Explorer 5.5 Using Group Policy, NSA Security Recommendation Guide, November 25, 2002. (local copy)
• Desktop Streaming: Technology and Security, Expertcity Inc., August, 31, 2002. (local copy)
• Mozilla Cookie Exploit(Analysis Report), Marc Slemko, Znep.com, January 22, 2002.
• Protect your network by customizing IE's desktop security settings, Brien M. Posey, TechRepublic, October 1, 2001.
• Block unauthorized sites and malicious code with Internet Explorer, Brien M. Posey, TechRepublic, September 12, 2001.
• Eliminate threats to your network by securing Internet Explorer's security zones, Brien M. Posey, TechRepublic, September 5, 2001.
• HotJava(tm): The Security Story, Sun Microsystems
• Microsoft's Internet Explorer security Center, Scott Schnoll
  
  [Cookie Security]
  
• Cookie Path Best Practice, Martin O'Neal, Corsaiire, April 5, 2004. (local copy)
• Have Web bugs invaded your systems?, John McCormick, TechRepublic, June 25, 2001.
• How Internet Cookies Work, HowStuffWorks
• Changing Your Cookie Settings, EarthLink
• Cookie Central, Cookie Central, - related with Cookie stuff
• The Unofficial Cookie FAQ v2.54, David Whalen, 2000
• INFORMATION BULLETIN I-034: Internet Cookies, CIAC, March 12, 1998
• Persistent Client State HTTP Cookies by Netscape
• HTTP Cookie Library - Cookie Resources
• 브라우저 쿠키 취약점, 임대호
  
  [Active X Control]
  
• ActiveX Control Tutorial, Microsoft
• Designing Safe ActiveX Controls, Microsoft
• Safe Initialization and Scripting for ActiveX Controls, Microsoft
  
  [Microsoft's Authenticode]
  
• Certificates and Authenticode page, Microsoft
• Authenticode White Paper, Microsoft, 1996
• Frequently Asked Questions About Authenticode, Microsoft, May 2000
  
  [DNS Security]
  
• DNS Appliance Architecture: Domain Name System Best Practices, Infoblox, April 2005. (local copy).
• The Basics of DNSSEC, Ibrahim Haddad and David Gordon, Onlamp, October 14, 2004.
• How to Increase the Security and Reliability of DNS, BlueCat Networks, Inc., September 1, 2004. (local copy).
• Practical Domain Name System Security: A Survey of Common Hazards and Preventative Measures, SecurityWriter, Nicholas A. Plante, May 25, 2004. (local copy).
• DNS: Defending Your Domain, Networkmagazine, Elizabeth Clark, January 5, 2004.
• DNS Architectures, BlueCat Networks, Inc., January 1, 2004. (local copy).
• Securing External Name Servers, Infoblox, January 1, 2004. (local copy).
• Attacking the DNS Protocol, Sainstitute.org, October 29, 2003. (local copy).
• The Domain Name System, Steve Steinke, Network Magazine, July 07, 2003.
• Preventing Vexation and Woe: DNS Fundamentals, Part 2, Carla Schroder, Earthweb, February 4, 2003.
• Preventing Vexation and Woe: DNS Fundamentals, Part 1, Carla Schroder, Earthweb, January 30, 2003.
• DNS Root Servers: Protecting the Internet, Rik Farrow, Network Magazine, January 06, 2003.
• DNS on the Hot Seat, Lynne Greer Jolitz, Byte Magazine, November 18, 2002.
• Securing an Internet Name Server, CERT/CC, August 2002. (local copy).
• Running the BIND9 DNS Server Securely, Sean Boran, SecurityPortal, April 30, 2001
• DNS and BIND, 4th Edition, Chapter 11: Security, Paul Albitz & Cricket Liu.
• DNS Security Extention, ACME Byte & Wire, 1999
• DNS Security, by Diane Davidowicz, 1999
  
  [Anti-Spam]
• Review: Spam Filters, Network Computing, Christopher T. Beers, November 18, 2005.
• Group Tests : Email filtering 2005, Ian Parsons, SCmagazine, March 2005.
• Spam in the Wild, The Sequel, NetworkWorld, Joel Snyder, December 20, 2004.
  - Analyzing the spam test result
  - Top spam fighters offer feature diversity
  - Adventures in spam testing
  - Why our numbers work
  - Where's SpamAssassin?
  - How we did it
  - Who got left out or opted out
  - What is a false positive?
  - Which comes first, anti-spam or anti-virus?

• Internet Email Traffic Emergency: Spam Bounce Messages are Compromising Network, Ironport, June 2006. (local copy)
• CipherTrust IronMail: World-Class Enterprise Spam Filtering, CipherTrust, 2006. (local copy)
• Spam Bashing: The 98 Percent Solution, Business Communication Review, Drew Robb, March 2005. (local copy)
• Why Content Filtering Is No Longer Enough: Fighting the Battle against Spam before It Can Reach Your Network, Postini, December 1, 2004. (local copy)
• E-mail at a crossroads, Cara Garretson, Network World, November 01, 2004.
  - Sender authentication hits roadblocks
• Spam Classification Techniques, MX Logic, October 1, 2004. (local copy)
• Thought Paper: Spamware - Email Address Harvesting Tools and Anonymous Bulk Emailing Software, MX Logic, October 1, 2004. (local copy)
• Explanation of Common Spam Filtering Techniques, Process Software, 2004. (local copy)
• SPAM Playbook: Spam-filtering Tools, Eric A. Hall, NetworkComputing, September 16, 2004. (local copy)
• How To Spam-Proof Your Network, Network Computing, Eric A. Hall, September 2, 2004.
• Best Practices for Enterprise Anti-Spam Detection, Proofpoint, September 1, 2003. (local copy)
• Fighting e-Mail Spam @ the Network: Foundry ServerIron SPAM-Def™ for Service Providers and Enterprises, Foundry Networks, Inc., September 1, 2004. (local copy)
• Putting Anti-Spam Solutions to the Test . . . Before You Buy, MailFrontier, August 1, 2004. (local copy)
• Spam Blocking Techniques, Michael Perone, Barracuda Networks, August 2004. (local copy)
• SPAM: It’s not just for breakfast anymore, Kurt E. Berger, SecurityWriter, July 2004. (local copy)
• The Anti-spam Cocktail: Mix It Up to Stop Junk E-Mail, Andrew Conry-Murray, NetworkMagazine, July 01, 2004.
• The Shifting Tactics of Spammers: What you need to know about new email threats, Postini, July 1, 2004. (local copy)
• The Silent Killer: How Spammers are Stealing Your Email Directory, Postini, June 20, 2004. (local copy)
• Technology and Policy Proposal, ASTA(Anti-Spam Technical Alliance)'s Technology and Policy Proposal, June 22, 2004. (local copy)
• Cloudmark's Spam "Immune System": Fighting Spam with Genetic Algorithms, Cloudmark, June 1, 2004. (local copy)
• Spam: The Serial ROI Killer, Nucleus Research, June 2004. (local copy)
• Filters Take a Bite out of SPAM: Newcomer to AntiSpam Wins Our Top Pick, Network Computing, Ron Anderson, May 13, 2004. (local copy)
  - AntiSpam Techniques: Sick of SPAM, Ron Anderson (local copy)
• Blocking a New Blend of Content Security Threats, Aladdin Knowledge Systems, Inc., May 1, 2004. (local copy)
• A Buyers Guide to Spam Filtering, BlackSpider Technologies, May 1, 2004. (local copy)
• A Guide to Centralized Spam and Virus Filtering, Amy Rich, Sun, May 2005.
• Stuffing Spam, AMBER PLANTE, InfosecurityMagazine, May 2004.
• E-mail is broken, Infoworld's Special Report, April 19, 2004. (local copy).
• Utilizing Open-Source Software to Build a (Relatively) Secure, Spam- and Virus-Free Mail Service, David Bailey, SANS Reading Room, April 16, 2004. (local copy)
  
• MLX: Machine Learning to Beat Spam Today and Tomorrow, Proofpoint, April 1, 2004. (local copy).
• SMTPi: An Email Security Architecture, IronPort Systems, April 1, 2004. (local copy).
• IronPort's Core MTA Architecture: The Revolutionary Queuing Engine That Powers the IronPort Messaging Gateway Appliances, IronPort Systems, April 1, 2004 (local copy).
• Eradicating Spam Through a Hybrid Sender-Pays Model, Ron Jager, SANS Reading Room, March 15, 2004. (local copy)
  
• Spam: From Annoyance to Threat, Clappymonkey, EBCVG, March 14, 2004.
• Anti-Spam Solutions and Security, Part 2, Dr. Neal Krawetz, SecurityFocus, March 9, 2004.
• Putting the Slam on Spam, Jim Carr, Networkmagazine, March 3, 2004.
• Bayesian Spam Filtering, Andy Dornan, Networkmagazine, March 3, 2004.
• Gartner's Magic Quadrant for Enterprise Spam Filtering, 1Q04, Postini, March 2, 2004. (local copy)
• Expert's Guide to Choosing an Anti-Spam Solution, Postini, March 1, 2004. (local copy).
• Three New Ways to Stop Spam - Preemptively, Postini, March 1, 2004. (local copy).
• The Challenges for Anti-Spam Technologies, Commtouch, March 1, 2004. (local copy).
• Anti-Spam Solutions and Security, Dr. Neal Krawetz, SecurityFocus, February 26, 2004.
• Implementing a SPAM Filtering Gateway with Apache James, Kraig Schario, SANS Reading Room, January 19, 2004. (local copy).
• The Cocktail Approach to Spam Protection, Astaro Corporation, January 5, 2004. (local copy).
• Delivering an Effective Anti-Spam Solution - What Does It Take?, Commtouch, January 1, 2004. (local copy).
• Recurrent-Pattern Detection (RPD™) Technology: The Challenges for Anti-Spam Technologies, Commtouch, January 1, 2004. (local copy).
• Spam: A Security Issue, CipherTrust, Inc., December 1, 2003. (local copy).
• Know your resources in the war against spam, Becky Roberts, TechRepublic, November 13, 2003.
• Spam: More than a Nuisance, CipherTrust, Inc., October 1, 2003. (local copy).
• Outwitting spammers, Julie Bort, Network World, September 29, 2003.
• The Rise of the Spammers, David Barroso, Berrueta, September 26, 2003. (local copy).
• Enterprise Requirements for Anti-Spam Solutions, Proofpoint, September 1, 2003. (local copy).
• Best Practices for Enterprise Anti-Spam Detection, Proofpoint, September 1, 2003. (local copy).
• How to Test an Anti-Spam Solution and Get Results You Can Trust, MailFrontier, September 1, 2003. (local copy).
• Spam - The Current State, Andrew Leung, TELUS Corporation, August 28, 2003. (local copy).
• Controlling Spam in a Small Business, Nadim El-Khoury, SANS Reading Room, August 30, 2003. (local copy).
• The Next Step in the Spam Control War: Greylisting, Evan Harris, August 21, 2003.
• Reputation-Based Mail Flow Control - Blocking Extreme Spam and Reducing "False Positives", IronPort Systems, August 1, 2003. (local copy).
• Winning the War on spam: Comparison of Bayesian spam filters, Dataparty, August 2003.
• SPAM : Take up the challenge of beating spam, SCmagazine, August 2003.
• Defending Your Site Against Spam, Part 2, Dru Nelson, Oreillynet, July 24, 2003.
• Strategies for canning spam, Infoworld, July 18, 2003.
• Combating SPAM Problems in a Corporate Environment, Brien M. Posey, SecurityWriter, July 11, 2003.
• Defending Your Site Against Spam, Dru Nelson, Oreillynet, June 26, 2003.
• Spam Filtering in a Small Business Environment, a Case Study, Richard Snow, SANS Reading Room, June 16, 2003. (local copy).
• Architectural Comparison of Enterprise Anti-spam Solutions, Tumbleweed Communications Corp., July 1, 2003. (local copy).
• The Problem with Spam Filtering : Balancing the Needs of Administrators with the End User, Sunbelt Software, June 1, 2003. (local copy).
• Understanding Proactive Vs. Reactive Methods for Fighting Spam, Tumbleweed Communications Corp., June 1, 2003 . (local copy)
• Fighting Spam in the Enterprise, Sendmail, Inc., May 1, 2003. (local copy).
• SPAM - Defining the Issues and Methods of Defense, Vigilar, Inc., May 1, 2003. (local copy).
• Fairly-Secure Anti-SPAM Gateway Using OpenBSD, Scott Vintinner, April 30, 2003.
• Spam, Spam, Spam, Lovely Spam, Brian Hayes, AmericanScientist, May 2003.
• Dealing effectively with spam, GFI, April 2003.
• Fighting the Spam Monster-and Winning, Andrew Conry-Murray, Network Magazine, April 04, 2003.
• Fighting the New Face of Spam, SurfControl, March 25, 2003. (local copy).
• Picking Your Anti-Spam Poison: The Spam Series, Part 2, Jacqueline Emigh, Earthweb, March 17, 2003.
• Stomping Out Spam: The Spam Series, Part 1, Jacqueline Emigh, Earthweb, March 10, 2003.
• The Spam Problem and the Brightmail Filtering Engine, Brightmail Incorporated, January 1, 2003. (local copy).
• The Spam Problem: Moving Beyond RBLs, Philip Jacob, Whirlycott, December 30, 2002.
• How to Combat Spam to Cost-effectively Minimize Productivity Losses, Astaro Corporation, November 3, 2002. (local copy).
• Top 10 Techniques to Control Spam for the Enterprise, CipherTrust, Inc., October 2002. (local copy).
• Securing the Mail: Lock Spam and Viruses Out of Sendmail, Dee-Ann LeBlanc, Earthweb, July 9, 2002.
• Fighting back against spam, Suzanne Gaspar, NetworkWorld, May 13, 2002.
• qmail Anti-Spam HOWTO(Version 0.33), Chris Hardie, Summersault.com, November 2001.
• Anti-Spam Provisions in Sendmail 8.8 by Sendmail.org

• Anti-spam, part II Jon Tullett, Scmagazine, June 28, 2004.
• Anti-spam, part I Jon Tullett and Rene Millman, Scmagazine, June 5, 2004.
  
  [Mail Security]
• 10 Essential Steps to Email Security, ClearSwift, 2007. (local copy)
• Messaging Management & Security: The Hosted Services Approach, Infoworld, 2007. (local copy)
• Mail Security, Infoworld, March 2007. (local copy)
• Gartner's Magic Quadrant for E-Mail Security Boundary, 2006, Gartner, September 25, 2006. (local copy)
• Ultimate Guide to Email Security White Paper, Clearswift, May 31, 2006. (local copy)
• Magic Quadrant for E-Mail Active Archiving-2006, Gartner, May 12, 2006. (local copy)
• Is Your Email Really Safe?: Firewall and Anti-Virus Software May Not Protect You As Well As You Think, RADirect, April 2006. (local copy)
• Blocking Access to Malicious URLs, IronPort, January 2006. (local copy)
• 2005 Annual Security Report MessageLabs Intelligence Annual Email Security Report, December 2005. (local copy)
• IronPort Email Security Appliance Overview October 2005. (local copy)
• IronPort Email Authentication October 2005. (local copy)
• Reputation-Based Email Security October 2005. (local copy)
• An Architectural Framework for Enterprise Email Security Sendmail, August 2005. (local copy)
• Magic Quadrant for E-Mail Security Boundary, 1H05 Gartner, June 30, 2005. (local copy)
• Identifying Dangerous EMail Robert Drum, SecurityWriter, January 2005. (local copy)
• MessageLabs Intelligence Annual Email Security Report 2004 MessageLabs, December 2004. (local copy)
• The Expert's Guide for Exchange 2003: Preparing for, Moving to, and Supporting Exchange Server 2003 - Chapter 8 : Exchange Security, Quest Software Inc., November 24, 2004. (local copy)
• The corporate threat posed by email Trojans, GFI, November 2004. (local copy)
• Email Security: A Holistic Approach For SMB, Insight, November 2004. (local copy)
• Ensuring Email Security, MX Logic, October 1, 2004. (local copy)
• Controlling Unwanted Content, MX Logic, October 1, 2004. (local copy)
• Executive Guide to Email Security, Postini, October 19, 2004. (local copy)
• Email Security Threats Pam Cocca, SANS Reading Room, September 2004. (local copy)
• Email Intrusion Prevention: Stop Malicious Threats before They Harm Your Email System, Postini, August 19, 2004. (local copy)
• FrontBridge Secure Email: Technology Overview, FrontBridge Technologies, Inc., August 1, 2004. (local copy)
• Know Something You Don\'t Know (Email Secrets), Bob Radvanovsky, SecurityWriter, August 2004. (local copy)
• Stop Email Fraud ... Before It Stops You, MailFrontier, July 30, 2004. (local copy)
• Outbound Email Security and Content Compliance in Today's Enterprise, Proofpoint, July 1, 2004. (local copy)
• Email Security - The IBE Advantage : Overcoming the Hurdles of PKI, Symmetric and Web-based Messaging, Voltage Security, July 2004. (local copy)
• Secure Web Based Mail Services, Keith Pasley, EBCVG, June 22, 2004
• Security (Beginner): Sendmail's Security, Linuxexposed, June 03, 2004.
• FrontBridge TrueProtect Email Boundary Security Service, FrontBridge Technologies, Inc., June 1, 2004. (local copy)
• National Do Not Email Registry, Federal Trade Commission, June 2004. (local copy)
• A Service-based Approach to the Email Fraud Problem, Brightmail Incorporated, May 24, 2004. (local copy)
• Why you need an email exploit detection engine, GFI, 2004. (local copy)
• How to Preemptively Eliminate the Top 5 Email Security Threats, Postini, March 1, 2004. (local copy).
  - Preemptive Email Security: The Case for Managed Services, Postini, March 1, 2004. (local copy)
• Outlook E-mail Security in the Midst of Malicious Code Attacks(Ver. 3.0), NSA Security Recommendation Guides, January 21, 2004. (local copy).
  - Old version(Ver. 2.5), August 2001. (local copy).
• Using Digital Signatures to Secure Email and Stop Phishing Attacks, Tumbleweed Communications Corp., January 1, 2004. (local copy).
• Banking Scam Revealed, Secure Science Corporation, SecurityFocus, November 13, 2003.
• Sobig and Beyond: Defining Email Security, CipherTrust, Inc., September 1, 2003. (local copy).
• SQL Server Email - vulnerability issues and prevention strategies, Frank Ress, SANS Reading Room, September 2003. (local copy).
• Building a secured open source mail system for Small Medium Enterprise (SME), Tan Han, SANS Reading Room, August 28, 2003. (local copy).
• Securing Electronic Mail in a Small Company, Nikolai Fetissov, SANS Reading Room, August 11, 2003. (local copy).
• Securing Internet Explorer Through Patch Management, Ben Meader, August 4, 2003. (local copy).
• Spam, Viruses, and Content Compliance: An Opportunity to Strategically Respond to Immediate Tactical Concerns, Proofpoint, August 1, 2003. (local copy)
• Securing Email Systems - An Overview of IronMail, the Secure Email Gateway, CipherTrust, Inc., July 1, 2003. (local copy).
• A quick view on sendmail, Linuxexposed, Jamie, July 03, 2003.
• E-mail Security at the Gateway, Andrew Conry-Murray, Network Magazine, June 04, 2003.
• 10 Keys to Safeguarding Your Email Systems, CipherTrust, Inc., June 1, 2003. (local copy).
• Trusted Email Open Standard: A Comprehensive Policy and Technology Proposal for Email Reform, ePrivacy Group, May 2003. (local copy).
• The Case For Secure Email, Erik Kangas, Lux Scientiae, March 2003. (local copy).
• Email security - SSL 3.1 / TLS 1.0 deployment, Ian Briggs, SecurityWriters, March 25, 2003.
• Exchange 2000 in the Enterprise: Tips and Tricks Part Three, Tim Mullen, SecurityFocus, February 20, 2003.
• Exchange 2000 in the Enterprise: Tips and Tricks Part Two, Tim Mullen, SecurityFocus, January 15, 2003.
• Exchange 2000 in the Enterprise: Tips and Tricks Part One, Tim Mullen, SecurityFocus, January 2, 2003.
• Email Threat Management Services, MX Logic's white paper, January 2003. (local copy).
• Securing Outlook, Part Two: Many Choices to Make, Scott Granneman, SecurityFocus, December 23, 2002.
• Securing Outlook, Part One: Initial Configuration, Scott Granneman, SecurityFocus, December 10, 2002.
• S/MIME - the reality of interoperability, ArticSoft, December 3, 2002. (local copy).
• The Sendmail Tutorial, CYDONIA, EBCVG, November 10, 2002.
• How To Secure Email Servers, CipherTrust, Inc., October 2, 2002. (local copy).
• The problems with Secure Email, ArticSoft, October 2002. (local copy).
• Secure Wireless Email, Mark Emery, Ciphertrust, October 2002.
• Mail Filtering, Michael Stevens, Perl.com, August 27, 2002.
• Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG, Kahil Jallad, Jonathan Katz and Bruce Schneier, Counterpane, August 2002. (local copy).
• Email security, Dr.T, EBCVG, July 08, 2002.
• Why You Need an Email Exploit Detection Engine, GFI Software, May 31, 2002.
• E-mail Security, MSExchange, May 16, 2002.
• Application-Level Defense: The Email Battlefield, Jay Chaudhry, SCmagazine, May 2002.
• Untangling Security Issues to Enable Web-based Email Access, Joseph Steinberg, SCmagazine, May 2002.
• EMAIL SECURITY : Juggling the Risks, Illena Armstrong, SCmagazine, May 2002.
• MailRecall: Secure E-Mail for the Enterprise, Authentica Inc., Whitepaper, May 1, 2002. (local copy).
• Securing Exchange 2000, Part 2, Chris Weber, SecurityFocus, May 8, 2002.
• Securing Exchange 2000, Part 1, Chris Weber, SecurityFocus, April 23, 2002.
• Email Systems: Threats and Defense, CipherTrust, Inc., April 19, 2002. (local copy).
• Email security, Help-net Security, April 2002.
• Mobile Email: Still Hindered By What Users Need Most, David A. Zimmer and Art Rosenberg, Commweb, April 1, 2002.
• Email security, GFI.com, Whitepaper, 2002.
• Protecting your network against email threats: How to block email attacks & viruses, GFI.com, Whitepaper, 2002.
• Using PGP to Verify Digital Signatures, Shawn Herman & Linda Pesante, CERT Cordination Center, March 19, 2002. (local copy).
• Email Tampering - This Time, The Good Guys Won, Michael Weingarten & Adam Weingarten, Business Communicatio Review, January 2002. (local copy).
• Analyzing and Addressing Microsoft Outlook/Exchange Security Issues, Novell, January 2002. (local copy).
• Understanding the Email-Borne Threat, Mary Landesman, InDefense, December 2001. (local copy).
• Certified Email with a Light Online Trusted Third Party: Design and Implementation, Martin Abadi, Neal Glew, Bill Horne & Benny Pinkas, 2001. (local copy).
• Building an E-mail Virus Detection System for Your Network, Dave Jones, LinuxJournal, November 16, 2001
• Encrypted E-mail: Close One Door, Open Another, Veronica Cuello, SANS Institute, November 21, 2001.
• Products to ensure e-mail security, Brian Fonseca, InfoWorld, September 21, 2001
• How to install GnuPG, Joe Barr, LinuxWorld, September 19, 2001
• A security analysis of Pretty Good Privacy, Sieuwert van Otterloo, SecurityFocus, September 4, 2001 (local copy)
• Securing Sendmail with TLS, Jose Nazario, Linux Journal, August 15, 2001
• GPG: the Best Free Crypto You Aren't Using, Part I of II, Mick Bauer, Linux Journal, August 15, 2001
• Email Login Security, Ric Steinberger, SecurityPortal, June 25, 2001
• Defective Sign & Encrypt in S/MIME, PKCS#7, MOSS, PEM, PGP, and XML, Don Davis, USENIX annual technical conference 2001 (June 25-30), 2001. (local copy)
• Email Login Security, Ric Steinberger, Security Portal, June 25, 2001.
• Attack on Private Signature Keys of the OpenPGP format, PGP programs and other applications compatible with OpenPGP, Vlastimil Klima and Tomas Rosa, Help Net Security, 2001. (local copy)
• E-MAIL SECURITY, Fred Avolio and David Piscitello, Information Security, May 16, 2001.
• A Brief Comparison of Email Encryption Protocols, Raph Levien, Arraydev, 2001.
• 메일필터링을 통한 E-mail 보안, 정보보호센터, 2001
• Allowing controlled SMTP relaying in Sendmail 8.9 by Sendmail.org
• Enhancing E-Mail Security With Procmail the E-mail Sanitizer, Home
  • E-mail based Attacks: Active Content attacks, Buffer Overflow attacks, Trojan Horse attacks, Shell Script attacks,
• A Chosen Ciphertext Attack Against Several E-mail Encryption Protocols , Jonathan Katz and Bruce Schneier, June 23, 2000
• Microsoft's E-mail Security Resources, Microsoft
• Customizing the Outlook 98/2000 E-mail Security Update, Microsoft Office Resource Kit Journal, June 7, 2000
• PGP documentation, The International PGP Home Page - documentation secction
  • How PGP works at The International PGP home
• The Postfix Home Page
  • Postfix Frequently Asked Questions
• The Qmail homepage
  • Qmail 한국 배포 운영사이트 - 위사이트의 문서 한글화 / 창작문서
  • qmail-HOWTO v2, Adam McKenna, Feb 20 2001
• E-mail and Executable Content Guides, NSA Security Recommendation Guides.
  1. E-mail Security in the Wake of Recent Malicious Code Incidents (22 pages)
  2. Guide to the Secure Configuration and Administration of Microsoft Exchange 5.x (62 pages)
  3. Microsoft Office 97 Executable Content Security Risks and Countermeasures (47 pages)
  4. Microsoft Office 2000 Executable Content Security Risks and Countermeasures (37 pages)

• Gateway Guardians Fred Avolio, InformationSecurity, February 2003.
• Group Test: Email security Craig Hinton, SCmagazine, February 2003.
• Review: Attacking spam at the network's edge Joel Snyder And Janet Trumbo, NetworkWorld, February 24, 2003.
• Test: Spam in the wild Joel Snyder, Network World, September 15, 2003.
• Competitive Evaluation of Spam-Blocking Solutions: The C/R Capabilities of DigiPortal Software’s ChoiceMail, EarthLink spamBlocker, Mailblocks Inc.’s Mailblocks Challenge Response 2.0, Qurb, Inc.’s Qurb and SpamArrest’s SpamArrest Tolly Group Whitepaper 203507, September 20, 2003. (local copy)
• Commercial solutions win, spam loses Logan G. Harbaugh, Infoworld, November 14, 2003.
  - Inside the spam filter, Logan G. Harbaugh, Infoworld, November 14, 2003.
• Mailprotector: Intelligent Spam and Virus Filtering Service, Leveraging Third-party Filtering Services to Improve Security and Reduce Overhead TollyGroup Whitepaper, 205104, April 21, 2005. (local copy)
• Email filtering 2005 SCmagazine, Robert Jaques, March 7, 2005.
• Test: E-mail encryption Network World, August 15, 2005.

  [abridged version of Professional WAP]

• Professional WAP I, Network Computing, July 3, 2000.
  • WAP and E-Mail
  • Key Elements of E-mail
• Professional WAP II, Network Computing, July 10, 2000.
  • Introduction to the Java Mail API
  • Simplifying WML Generation
• Professional WAP III, Network Computing, July 17, 2000
  • E-mail and E-commerce Sites
  • A WAP Based E-mail Application
  • Summary
  
  
  [NFS Security]
  
• NFS Security, Samuel Sheinin, May 2, 2000
• NFS and NIS Security, Kristy Westphal, Jan 22, 2001
• NFS Security -Sun Whitepaper, Sun Microsystems
• NFS HOWTO : Security and NFS, Linux Online, 2000
• Introduction to NFS Security - Technical Report, Paul Ashley, Dec, 1996
  
  [NIS/NIS+ Security]
  
• Securing NIS (formerly YP), Doug Hughes
• Network Information Services (NIS and NIS+) Guide - Chapter 7. Security, University of California
• NIS+ part 1: What's in a Name (Service)?, SunWorld, Oct, 1996
• NIS+ part 2: Not your father's name service, SunWorld, Oct, 1996
  
  [X-window Security]
  
• Securing X Windows, John Fisher, CIAC-2316, August, 1995
• X Security, Lionel Cons, It's a part of CERN Security Handbook, Dec. 1996
• X Security, Francois Staes
• X Security, University of Cambridge
• Crash Course in X Window Security, Beckman Institute System Services

  [SSL/TLS]

• Securing Your Online Data Transfer with SSL: A Guide to Understanding SSL Certificates, How They Operate and Their Application..., Thawte Consulting (Pty) Ltd., July 12, 2004. (local copy)
• Certify Your Software Integrity with Thawte Code Signing Certificates, Thawte Consulting (Pty) Ltd., April 1, 2004. (local copy)
• Securing Your Microsoft Internet Information Services (MS IIS) Web Server with a Thawte Digital Certificate, Thawte Consulting (Pty) Ltd., January 1, 2004. (local copy)
• Building Customer Confidence with Thawte SSL Web Server Certificates and SuperCerts, Thawte Consulting (Pty) Ltd., January 1, 2004. (local copy)
• Exploring RSA Encryption in OpenSSL, James Tandon, LinuxJournal, September 25, 2003.
• The easiest way to get around SSL, Robert Larcher, September 3, 2003. (local copy)
• Remote timing attacks are practical, D. Boneh and D. Brumley, Stanford Univ., March 2003. (local copy)
• Password Interception in a SSL/TLS Channel, Brice Canvel, LASEC, February 2003.
• Tutorial : SSL and TLS, David Greenfield, NetworkMagazine, December 4, 2002.
• Security holes... Who cares?, Eric Rescorla, RTFM Inc., November