Solid list. A few more: - Threat modeling: “Security Engineering” by Ross Anderson and the EFF threat modeling guides • Operational mindset: Schneier’s essays on real world security tradeoffs • Failure analysis: postmortems and writeups of what didn’t work (often more valuable than su...