Formal education and training in preparation for the practice of a profession.

learn more… | top users | synonyms (2)

88
votes
15answers
15k views

What “hacking” competitions/challenges exist? [closed]

I have always enjoyed trying to gain access to things I'm not really supposed to play around with. I found Hack This Site a long time ago and I learned a lot from it. The issue I have with HTS is that ...
57
votes
18answers
3k views

What security resources should a white-hat *developer* follow these days?

What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days? Do Include: Late breaking information on new security issues (RSS, Twitter, etc) A website that ...
37
votes
9answers
6k views

Books about Penetration Testing

What are the books you advise describing methods or steps required to make a successful penetration test? I have a base knowledge of common security checks, but it would be great if someone more ...
28
votes
13answers
1k views

Courses on “Secure Software Development”

This semester, I'm offering a course on "secure software development." The course is divided into three parts: Secure Software Engineering Reverse Engineering Secure Coding Do you know any courses ...
28
votes
9answers
2k views

I see entry level security skills as a problem for industry - what can we do about it?

Okay, so we push corporates to improve security, and provide training to IT staff and awareness presentations to CEO's etc, but each year a new batch of graduates are brought in to companies as others ...
26
votes
3answers
957 views

The valid role of obscurity

That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
26
votes
12answers
2k views

List of good security blogs one should read

I graduated this year and am working in the security domain. I want to explore security topics and don't have a strong background since it was not part of our curriculum. Can you list some good ...
24
votes
6answers
421 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
23
votes
11answers
4k views

Resources to learn about security

I am currently just finishing a undergrad computer science degree, but I know very little about computer security. What are some good resources (aside from this site) to learn the fundamentals of ...
23
votes
5answers
2k views

Professional certifications for IT Security

Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist. Information Security CEH ...
22
votes
10answers
3k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
22
votes
10answers
9k views

Good (preferably free) resource for CISSP practice questions

I'm looking to sit for my exam in a few weeks, and I want to have a good set of practice tests to bounce against and make sure that I'm up to par with the types of questions that will be asked.
22
votes
13answers
22k views

How to learn penetration testing at home?

I am interested in learning ethical hacking or penetration testing to head towards a career in that direction. I have a strong knowledge of linux and unix, basic computer theory and practice and ...
22
votes
5answers
1k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
20
votes
7answers
7k views

If you could have only one book on web security, what would it be?

If you could have only one book on web security, what would it be?
18
votes
6answers
4k views

As a beginner in IT Security, should I learn TCP/IP?

I'm a university lecturer and a web and desktop software developer. For many reasons I want to learn software security to change my field in the long run. It's been a few days that I've started ...
18
votes
4answers
639 views

How would you reason with and work with the security paranoiac on your team?

The question of how to balance pragmatism with an absolutist view of security has been discussed here already. But I need the answer to a concrete variant of that question. You're the security expert ...
17
votes
7answers
513 views

which site do you use to view details of vulnerabilities?

Which site/sites do you guys use to view details of security vulnerabilities?
16
votes
4answers
702 views

Tricky code to make memory-safe

I'm designing a homework challenge for students who are learning about memory safety and writing secure C code. As part of this, I am looking for a small programming task where it's non-trivial to ...
14
votes
8answers
2k views

List of good security podcast one should listen to

I'm a hard core dyslectic who wants to read up on all things security without the reading part. So I want to know what good high quality security podcasts are there? I'm interested in almost ...
14
votes
8answers
2k views

Is advanced mathematics relevant to security beyond cryptography?

Short question. The title says it all... is advanced mathematics (i.e. beyond the classic college level calculus sequence) relevant to any field of computer security besides cryptography? By relevant, ...
14
votes
4answers
584 views

Application security training for developers

I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
12
votes
5answers
796 views

How to get into RFID auditing?

I would like to get more knowledge around RFID-systems auditing. Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment? I would like to ...
12
votes
2answers
303 views

Should a pentest report include the tester's opinion?

In this particular case, the webserver turned out to be a shared 3rd party system and was not tested. Examples: We do express grave concern at the overall security posture of that webserver and ...
11
votes
4answers
529 views

How to convince your boss about importance of IT security

Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security? There are a couple of known good practices in the field of IT security. ...
10
votes
2answers
429 views

Should a penetration tester have training in ISO 27001/ITIL etc?

I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
10
votes
2answers
592 views

What is a “pre-play” attack?

I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
9
votes
7answers
14k views

Programming language for network security

I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
9
votes
4answers
2k views

Is Schneier's “Applied Cryptography” current?

I've been recommended Bruce Schneier's 1994 book Applied Cryptography as an introduction to the use and the inner workings of cryptography. Is this book still current and a good introduction?
8
votes
5answers
313 views

In what ways do some banks inadequately advise their customers on online security?

I'm looking for specific examples of things such as: Misleading, but common advice Advice which has backfired Advice which is just, quite simply, incorrect which have been circulated time and time ...
7
votes
8answers
387 views

Topics for SecureCoding course in C

So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around ...
7
votes
5answers
336 views

What should students learn about security in an introductory programming course?

Some folks have advocated that security should be integrated into computer science coursework, throughout the curriculum. Suppose we are going to add one lecture on security, to a first course on ...
7
votes
5answers
1k views

Best Security Conferences? [closed]

Not sure if this question is too broad, if it is please let me know, we could probably turn it into a wiki. I'm posting this as a reference for other users. What would you say are the best ...
7
votes
2answers
478 views

How to attract hackers?

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to ...
7
votes
1answer
2k views

SANS training - worth it?

I am a programmer, doing mostly web development now, dealing also with securing the web applications in my line of work. I have reasonable knowledge of security matters, though not always staying ...
6
votes
5answers
904 views

Where should I go from here to be a pentester?

I would like some tips on what I can study to be a better penetration tester. That is what I would like to work towards being, although I have trouble knowing where to start. I have a decent ...
6
votes
5answers
924 views

Firewall demo - iptables

I have to make a demonstration about firewalls in my class as a student(university). It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
6
votes
10answers
571 views

networking and security

I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about ...
6
votes
2answers
4k views

What preparation do I need to fullfil for OSCP?

I am new to this whole Offensive Security field. Also I have not spent much time in IT. 6 months back I started running behind Offensive Security & started studying. First I studied for C|EH and ...
6
votes
2answers
202 views

dealing with small businesses and security issues

I am dealing with a small business that I have no choice right now but to deal with. I do not work for this business but my personal life dictates that I use them right now. I noticed a few months ago ...
6
votes
1answer
748 views

What are the good resources for learning Metasploit?

Ok. I'm a newbiw (Script kidde) and I want to learn more about Metasploit. Not for fun, but to understand what exploits are, how they are used, and deployed. I've heard a lot about the Metasploit ...
6
votes
2answers
369 views

How to explain computer security to low-grade students?

This is my first question here on Security, so please forgive me if I'm in the wrong place for asking this. I am a computer science teacher currently teaching classes of teenage students age between ...
5
votes
5answers
628 views

Where can I find a mentor/teacher in computer security?

I really enjoy computers - especially security. That's why I went to a school profiled as technical/IT. However, they teach crap. They don't know anything after the release of windows xp/2003. When ...
5
votes
1answer
219 views

Jobs Regarding Network Security

I am new college graduate from India with no job experience. I have deep interest in Information Security and would like to a work for any good company related to the field. Since I don't have ...
5
votes
4answers
3k views

CEH or GIAC - Which one should I pursue?

After a lot of Google and forum searches, I found out CISSP is one of the few valuable certs. Unfortunately, I only have 2 years of experience and don't have any specific experience in security ...
5
votes
2answers
606 views

Beginners materials for web security [duplicate]

Possible Duplicate: Resources to learn about security What materials can I study to learn web development security. I'm a web developer, I use ASP.NET, Java, PHP, and JavaScript. I want to ...
5
votes
3answers
623 views

CEH resources for exam prep

For an upcoming contract I'm required to have the CEH certification (even though there won't be much PenTesting) so I'm working through that now. I've gone through all of the reccomended EC Council ...
5
votes
3answers
389 views

What are some signs that a certain degree in information security will be a quality one?

I have been searching frantically for a college that has a good information security program. One of the ones I came across is Wilmington Universities Computer and Network Security program. I got a ...
5
votes
3answers
933 views

Is a Master's in infosec required to break into the security field?

So I'm going to be graduating college in January 2013, with a double major in Compsci and Cell Biology (don't ask...). I'm really looking to break into the information security field as a consultant. ...
5
votes
2answers
1k views

Beginner level security for a CS student

I am a final year CS student, and would like to study info sec. Till today, I've been reading infosec mailing lists, some Phrack papers etc., but all in a very casual way. I am interested in learning ...