Bruce Schneier and Neils Ferguson's latest: Practical Cryptography.

I don't have the time for an exhaustive review, here, but I wanted to share a couple of (LRPD-candidate) gems:

1) page 356: "..given the choice between security and downloading a program that will show dancing pigs on the screen, users will chose dancing pigs just about every time."

2) page 382: "WEP wasn't just broken; it was robustly broken."

In all, a brilliant follow-up to Applied Cryptography, central points being that a) good strong crypto is both wonderful and "fiendishly difficult", and b) other attack vectors are much easier to exploit; in other words, it's implementation that bites a lot of applications, not the crypto itself.

Well worth the read; especially if you're in the middle of recommending new secure voting mechanisms that "don't sound too difficult to implement" (ahem).

You don't need to read Applied first. The order in which (and whether) you read them both depends largely on your level of experience in the security industry and your current and perceived future role in it.

I would say, if you are a developer of any sort, you should read Practical Cryptography. It covers implementation concerns which affect everyone from marketing bigwigs to project leads to crypto experts to code jockeys. The math is limited to "what the authors had in high school," and isn't necessary to comprehend in full in order to appreciate the central thrust of the book. But it helps. Word of warning, however (from the authors): the book is a dangerous one, and will be abused more than put to good use. Not much one can do about that in a lazy world.

Applied Cryptography is much more geared to the "security experts" among us, and in particular to those designing cryptographic, as opposed to merely security or other software. For example, Applied delves into the algorithmic details of block ciphers (such as DES), hashes, and key exchange. If you are not actively involved in the creation (which hopefully includes design ;) of cryptographic protocols, skip this one and read Practical instead.