I've been reading a number programming/security topics lately, but the topic of security goes much farther as we alter business processes through developing and implementing new tools in the workplace. Books like "Writing Secure Code" focus on individual systems which is a great step, but there is a larger picture at stake here as well.
I remember taking "Accounting Systems" in school that focused on developing procedures that introduce multiple parties throughout a process for the sake of checks and balances. In my experience , these types of systems are not adequate - bordering on grossly inadequate. When you create a multi-step solution with differing parties reviewing the information, you lose the prospect of continuity/control which can be exploited. The individual steps are very secure, but in turn, the entire process becomes vulnerable( in programming, we're talking about integration points here.) People introduce their scheme at a given step in the process and go through extensive steps to make the process look like it is legitimate. Once that process is accepted, the entry point gains familiarity with the "transaction type" and it's never questioned again. It's really very similar to hacking techniques.
I've seen this on a number of levels. I've seen program managers introduce consulting firms owned by themselves to their own company to work on their own projects (this person was physically escorted off the premises by security while kicking and screaming). I've seen DNR wardens who start up their own "Friends of the Environment" group who's sole registered purpose is to raise money - no member lists, no minutes. These are all products of systems that are out of control.
I've been looking for books that cover security from this angle - books that go beyond the traditional 'Accounting System Security' to look at analyzing the unintended implications of security decisions. I haven't found any yet. I keep thinking I should blog some of these experiences, but on one hand they land outside the realm of programming, but on they other hand they ultimately apply to all the processes we engineer.