What's the Security equivalent to SICP?

Question

For those of you who don't know any developers and/or didn't go to MIT, The Structure and Interpretation of Computer Programs is the Canonical reference on it's title subject. It is often used as the text in begining comp sci classes.

What, if anything, is the equivalent book in information security (please don't respond with anything that contains CISSP in the title)

Edit: As I responded below, I'm really looking more for a book (or collection of books) to give to neophytes (think college intern) to help them achieve the correct mindset. You may have noticed we don't really think about the world the same way most people do...

Answer 1

To add to some other answers as people have mentioned there's a lot of different areas to security and they're not all suited to book-based learning. That said you could look at Security Engineering by Ross Anderson. This is what popped into my head first when you said you're looking for a security equivalent to SICP.

It's somewhat academic in tone, but has good coverage of a lot of the fundamental issues in security.

Answer 2

I recommend Bruce Schneiers Secrets and Lies, which I read recently. It's a good introduction, but not the same way SICP is an introduction to programming. It does a good job with teaching mentality though.

Answer 3

Your question is too broad in scope for an answer. 'Security' covers such a vast scope. Network security, OS security, application security, device security, physical security, human security. These are all topics that an IT security professional needs to have experience and knowledge in, and there can be no single point of reference to spring from.

Sources like that certification, which I will not name, actually cover all those areas, although I am not trying to promote that certification as the fundamental and foundational body of knowledge.

Answer 4

Security doesn't have a bible. Security discussion stems from insecure practices, and those are often dependent upon the problem at hand. Because most issues today were minor or not critical a decade ago, there isn't a solid published pragma. The field is just starting to really mature.

Without the concrete truths of computer science, developing such a thing would be more challenging.

With that said, I've been really happy with the collection of knowledge around this site over the past year. If I were to try writing such a thing, Security.SE would be my starting point. With that said, these are the two bullet points that I feel you should carry at a minimum:

• Security is a process
• Security is a mindset

Answer 5

Written materials are possibly the least suited media to encourage a mindset which needs to think 'outside the box' (to use a horrible phrase.) When attackers are looking at any way to get in, having a structured way to think imposed upon you as a defender is not good.

Interestingly, of the books I would recommend, most are not security books, but top of my list would have to be Cory Doctorow's Little Brother which you can get for free download at that link.

If you think any of it is unrealistic, then I would say you are not paranoid enough, or aware enough of what can be done. It focuses heavily on personal freedom and privacy, but the implications are essentially in the security space.

Additionally, encouraging students to carry out their own Mythbusters work also helps with a mindset that questions and tries to break/analyse anything and everything.