Shannon, C. E. (n.d.). A Mathematical Theory of Communication. Bell System Technical Journal, 27(3), 379–423.
How to Think About Security, Whittaker & Ford, IEEE Security & Privacy, 2006
Learning how to think about security means adopting a different mindset than we've had in the past. As a community, software developers have been thinking too much like "good guys" and thus ended up developing insecure software because they failed to predict attack scenarios. The only way to effectively develop good security in software is to learn to think like the "bad guys." Thinking like the adversary helps us to better identify and mitigate threats
Whittaker, J. A., & Ford, R. (2006). How to think about security. IEEE Security & Privacy, Security & Privacy, IEEE, IEEE Secur. Privacy,
4(2), 68–71. https://doi.org/10.1109/MSP.2006.39