I think a good start would be to read http://www.amazon.com/Art-Software-Security-Assessment-Vulne...