Salesforce has been telling us to move to permission sets for years now. Most orgs are still sitting on a pile of custom profiles and dreading the migration. Here's how to actually do it, what you can't move yet, and the gotchas that'll bite you if you aren't careful.
Salesforce Security
OWD, sharing, profiles, permissions -- the full security model.
