Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I graduated this year and am working in the security domain. I want to explore security topics and don't have a strong background since it was not part of our curriculum. Can you list some good security blogs which explore various security strategies. It could be any kind of security like network security, information security, SOA security, Identity, access, authorization etc.

Note: for developer-oriented resources, see this question:

What security resources should a white-hat developer follow these days?

share|improve this question
This seems like a duplicate of [this question][1]. Remember to check the questions already asked - the search function is pretty good. [1]: – Rory Alsop Feb 25 '11 at 10:00
@RoryAlsop - It looks like normal markdown coding doesn't work for URLs in comments. Regarding the question, I'm not 100% sure it's really an exact duplicate. This seems to be more generalized, whereas the other question specifically seeks to address the needs of developers. – Iszi Feb 25 '11 at 14:46
Perhaps this question could be geared for non-coders? – LamonteCristo Feb 28 '11 at 17:26
Coverted to wiki as "List of ..." question... – AviD May 3 '11 at 10:49

15 Answers 15

If you want to learn more about the security domain, blogs are not where I'd start. I'd start with classic books. Ross Anderson's Security Engineering is an absolute classic, a must-read for anyone in the business. Others may have other suggestions.

As for blogs, here are a few suggestions:

share|improve this answer

For application security, I recommend the OWASP Moderated Application Security News Feed. From the website...

"There are hundreds of bloggers, journalists, hackers, and others who write about application security. The problem is that most of the notes written are simply not very interesting or useful to busy application security professionals. To help with this onslaught of application security news, the OWASP Team reviews over 130 of these sources and produces the OWASP Moderated Application Security News Feed. The OWASP Team only selects high-quality posts focused on application security that advance the field, provide useful insight, or are useful educational resources. We don't post 0-day information and we try to avoid posts that are commercial in nature or promote one company's product or services."

share|improve this answer

I would highly recommend to everyone interested in security/hacking The Open Pentest Bookmarks Collection project.

It's a project collecting all the best sites and dividing them into categories. Also everyone can suggest a site that might be interesting.

For the full list see the wiki page:

share|improve this answer offers a fantastic security blog in addition to exploits, white papers, and other goodies. It is a great resource.

On an (somewhate) unrelated note, I might recommend reading the Security+ test prep book. Taking the test isn't 100% necessary but the book gives you a great overview of many topics in the Security field.

share|improve this answer
My virus protection software is flagging the link above as a known web threat. This could be a false-flag, but let the user beware. – Mark Jun 30 '12 at 18:29
@Mark - worth checking the settings on your AV. It may be flagging a false positive. – Rory Alsop Jul 2 '12 at 7:41

I'll add Naked Security news. Multiple blogger post there, so there are often several new articles a day. They cover all sorts of security topics like malware, spam, social engineering attacks, etc.

share|improve this answer

The Security Stackexchange Blog is also developing well - providing insight into hot security topics in industry, as well as areas which are in demand by users of this site.

share|improve this answer
Corporate Shill! – Scott Pack Dec 17 '11 at 2:30
Heh - izzat you stickin' it to da man, @Scott – Rory Alsop Dec 17 '11 at 10:23
share|improve this answer

Eric Rescorla's blog, not always on security, always enjoyable

share|improve this answer

All good answers. I would also add:

SANS Internet Storm Center -

Dancho Danchev -

share|improve this answer

Voltage Security's blog - is one security blog I enjoy reading among other listed here.

share|improve this answer

Follow the twitter feeds of community members and open source projects you enjoy. You can start off by going through some of the blogs listed here and adding the feeds of authors. Look at re-tweets to guide expanding the list and prune those who microblog the useless details of their personal lives.

share|improve this answer

Matt Green's blog regularly has pretty thorough posts on current cryptographic attacks and protocols. It also has some pretty good discussion of the politics and policy around crypto currently.

share|improve this answer

No list is complete without a mention of the twitter-only @SwiftOnSecurity which is something of an infotainment meta-blog, featuring links to current infosec topics (and some, uh "miscellaneous stuff") on a daily basis. The operator also runs a companion how-to site,

share|improve this answer

protected by Community Sep 15 '11 at 8:34

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.