The Art of Software Security Assessment by John McDonald & Mark Dowd