My recommendations would add:
http://www.amazon.com/The-Codebreakers-Comprehensive-Communi... by David Kahn. Many stories of the whole history of secret communications, with lessons in op-sec, not changing the codes frequently enough, they can't possibly break this.
The John LaCarre http://en.wikipedia.org/wiki/John_le_Carr%C3%A9 books. Do you remember the point where someone says to Smiley "There is no reason to think that they tapped the phone" to which Smiley replies "There is Every reason".
A must read, I tell my students in my Security Awareness training classes is The Cuckoo's Egg http://www.amazon.com/The-Cuckoos-Egg-Tracking-Espionage/dp/.... Examples like default service accounts on Dec Vax with username Field and password Service. Note when this is written and are our habits really any better with junk hung on the internet? Concepts pioneered in his book, as effective as they are, are not practiced. Note the alarms going off, ignored, at a large retailer last thanksgiving. Or another retailer recently, "Wait, what, we are being attacked? I didn't feel anything".
Most vulnerable is the thinking "Well, they can't get our X because ". I have a matrix of attacker motives and what they are after. There motives and targetsyou haven't thought of.