Cigital has a nice list of papers and other software risk publications located at www.cigital.com/papers.