This is a good basic overview of Drupal security for admins, module developers and themers. One thing that surprised me is that it did not really cover security on a site using SSL (such as an Ubercart site or perhaps a membership site with secure login).