Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am currently just finishing a undergrad computer science degree, but I know very little about computer security.

What are some good resources (aside from this site) to learn the fundamentals of security. I realise that good resources will probably vary depending on specifically what sort of security each is aimed at.

I've looked at this Linux Security HOWTO: http://tldp.org/HOWTO/Security-HOWTO/index.html

The question can be rephrased: If you were forced to employ someone in my situation (solid knowledge algorithms/data structures, a few languages and different programming paradigms and basic Unix knowledge), what would you make them read/learn?

share|improve this question
    
You may take a look at this topic. –  Sadeq Dousti Nov 13 '10 at 4:27
2  
Again, employ for what position? –  AviD Nov 14 '10 at 2:32
2  
You can start here security.stackexchange.com/questions/486/… –  bretik Nov 22 '10 at 14:01
1  
Is this a dupe of security.stackexchange.com/questions/2226/…;? –  user185 Feb 23 '11 at 10:57
    
@graham Looks remarkably similar –  Rory Alsop Feb 23 '11 at 23:48
add comment

10 Answers

I highly recommend Ross Anderson's Security Engineering. The first edition is available as PDFs for free.

From Chapter 1:

Security engineering is about building systems to remain dependable in the face of malice, error, or mischance. As a discipline, it focuses on the tools, processes, and methods needed to design, implement, and test complete systems, and to adapt existing systems as their environment evolve.

share|improve this answer
add comment

Learning how to secure something means you understand, at a deep level, how that thing works and what it's weaknesses are. Risk assessment is also a big part.

I'm sure there are plenty of links to be found to security sites, mailing lists and books, but it really all comes down to understanding the weaknesses of the system and assessing the possible threats.

Generally, the best resource to securing something will be that things manual and your own critical thinking.

share|improve this answer
add comment

There are a range of organisations who will not employ directly into security consulting or security audit roles unless you can evidence strong IT experience. This does help to build a more rounded, practical view of security in a real world operational environment, whereas sometimes when I have hired new graduates of security degrees they have required so much training in order to bring their ideas of security down from an 'ideal' but unworkable position to a practical level.

Examples of areas I have most successfully hired from - networking and firewalling (CISCO, Checkpoint, Telecoms etc), Computer Science degrees, Security and Forensics degrees.

And my most useful training for them - on the job with an experienced pro, first in audit roles, then consulting.

share|improve this answer
add comment

Safari Books Online: http://www.safaribooksonline.com/

Amazon's Bestsellers in Computer Security & Encryption: http://www.amazon.com/gp/bestsellers/books/377560011/

share|improve this answer
    
+1 for mentioning Safari books. I have a membership through my corporation and Im loving it. I would never go back! :) I also have my ipad hooked up to it making it easy to look up information anytime anywhere. –  Chris Andrè Dale Nov 24 '10 at 20:56
add comment

The best way to learn is by having fun doing so. Thats why I got fond for "wargames" or hack challenges.

I would check out: http://hackquest.com/

And also:

http://www.slavehack.com/

http://www.overthewire.org/wargames/

For video tutorials and lectures I use:

http://securitytube.net/

share|improve this answer
add comment

As you said, it really depends in what field of security you're referring to...
If you're looking for application security information, go straight to OWASP. Start there, lots of places to go after.

share|improve this answer
add comment

NYU:Poly has their whole security course about pen testing online: Penetration Testing and Vulnerability Analysis

share|improve this answer
1  
Actually, this link was already mentioned in "Linked" topics, that directs to security.stackexchange.com/questions/1/…. –  anonymous Nov 22 '10 at 14:51
add comment

Community side: IRC is your friend, imo. Otherwise I like those:

About written resources, I found extremely useful the security section of the FreeBSD Handbook. Computer Security is an huge landscape - depends on what are you looking for.

share|improve this answer
add comment

There is a huge variety of books on information security available for free. A simple google would make the deal in case you have the necessary topics!

Hereafter my personal recommendation as a must to enter to that world:

  • How to integrate security in software development lifecycle. You would get the Microsoft SDL (that would consume some of your time to read it and familiarize yourself with each topic separately), Building Security In (e.g. BSIMM...), security requirements, secure programming... With that you should cover (as i referred to the sub topics importance) security testing, fuzz testing, code review, ...

  • On the other hand you would need to learn the technology specific security solutions, like security for html frames..., access control models from the application layer until DBMS, security protocols and why are they used, security for web technologies and for RESTful web services or SOAP based web services.

  • Security properties offered by frameworks and IDEs, .Net framework, ...

Try googling for these, in case you couldn't get useful link, i would be able to provide it for you just leave me a comment.

share|improve this answer
add comment

That's a tough question to answer, because "Computer Security" is a very broad field--

If you are looking for just general computer security stuff, I would start following Richard Bejtlich, who has authored a couple very good network security & forensic books--But he also deals with the philosophical mindset of computer security--For instance, from the Tao of Network Security Monitoring:

Security is the process of maintaining an acceptable level of perceived risk. A former director of education for the International Computer Security Association, Dr. Mitch Kabay, wrote in 1998 that “security is a process, not an end state.” No organization can be considered “secure” for any time beyond the last verification of adherence to its security policy. If your manager asks, “Are we secure?” you should answer, “Let me check.” If he or she asks, “Will we be secure tomorrow?” you should answer, “I don’t know.” Such honesty will not be popular, but this mind-set will produce greater success for the organization in the long run.”

I would also recommend Bruce Schneier, & most of SANS resources.

-Josh

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.