An oldie but a goodie, Marcus Ranum’s “Six Dumbest Ideas in Computer Security” are a great read. I think my favorite is #2, “Enumerating Badness.”