Formal education and training in preparation for the practice of a profession.
68
votes
13answers
6k views
What “hacking” competitions/challenges exist?
I have always enjoyed trying to gain access to things I'm not really supposed to play around with. I found Hack This Site a long time ago and I learned a lot from it. The issue I have with HTS is that ...
47
votes
18answers
3k views
What security resources should a white-hat *developer* follow these days?
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that ...
28
votes
9answers
2k views
I see entry level security skills as a problem for industry - what can we do about it?
Okay, so we push corporates to improve security, and provide training to IT staff and awareness presentations to CEO's etc, but each year a new batch of graduates are brought in to companies as others ...
28
votes
8answers
4k views
Books about Penetration Testing
What are the books you advise describing methods or steps required to make a successful penetration test?
I have a base knowledge of common security checks, but it would be great if someone more ...
25
votes
3answers
674 views
The valid role of obscurity
That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no ...
24
votes
13answers
782 views
Courses on “Secure Software Development”
This semester, I'm offering a course on "secure software development." The course is divided into three parts:
Secure Software Engineering
Reverse Engineering
Secure Coding
Do you know any courses ...
24
votes
12answers
1k views
List of good security blogs one should read
I graduated this year and am working in the security domain. I want to explore security topics and don't have a strong background since it was not part of our curriculum. Can you list some good ...
22
votes
6answers
304 views
How to keep an eye on upgrades, patches and security issues for used open-source libraries?
For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
19
votes
5answers
718 views
How to improve as a security expert
I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
18
votes
5answers
2k views
Professional certifications for IT Security
Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist.
Information Security
CEH ...
18
votes
10answers
2k views
Resources to learn about security
I am currently just finishing a undergrad computer science degree, but I know very little about computer security.
What are some good resources (aside from this site) to learn the fundamentals of ...
17
votes
6answers
2k views
As a beginner in IT Security, should I learn TCP/IP?
I'm a university lecturer and a web and desktop software developer. For many reasons I want to learn software security to change my field in the long run. It's been a few days that I've started ...
17
votes
4answers
532 views
How would you reason with and work with the security paranoiac on your team?
The question of how to balance pragmatism with an absolutist view of security has been discussed here already. But I need the answer to a concrete variant of that question.
You're the security expert ...
17
votes
6answers
3k views
Good (preferably free) resource for CISSP practice questions
I'm looking to sit for my exam in a few weeks, and I want to have a good set of practice tests to bounce against and make sure that I'm up to par with the types of questions that will be asked.
16
votes
7answers
422 views
which site do you use to view details of vulnerabilities?
Which site/sites do you guys use to view details of security vulnerabilities?
14
votes
8answers
615 views
Is advanced mathematics relevant to security beyond cryptography?
Short question. The title says it all... is advanced mathematics (i.e. beyond the classic college level calculus sequence) relevant to any field of computer security besides cryptography? By relevant, ...
14
votes
10answers
7k views
How to learn penetration testing at home?
I am interested in learning ethical hacking or penetration testing to head towards a career in that direction.
I have a strong knowledge of linux and unix, basic computer theory and practice and ...
13
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
13
votes
8answers
1k views
List of good security podcast one should listen to
I'm a hard core dyslectic who wants to read up on all things security without the reading part. So I want to know what good high quality security podcasts are there? I'm interested in almost ...
13
votes
2answers
230 views
Should a pentest report include the tester's opinion?
In this particular case, the webserver turned out to be a shared 3rd party system and was not tested.
Examples:
We do express grave concern at the overall security posture of that webserver and ...
13
votes
5answers
482 views
How to get into RFID auditing?
I would like to get more knowledge around RFID-systems auditing.
Does anyone have a basic guide step-by-step which I can use to set up a lab with proper RFID "sniffing" equipment?
I would like to ...
12
votes
7answers
2k views
If you could have only one book on web security, what would it be?
If you could have only one book on web security, what would it be?
10
votes
3answers
205 views
Application security training for developers
I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
10
votes
2answers
427 views
What is a “pre-play” attack?
I understand what a replay attack is, but I keep reading about a pre-play attack. What is it? Is it when someone intercepts an unused message and blocks the sender so they can't finish using it, and ...
9
votes
6answers
718 views
Video Tutorials resources for IT Security
I am looking for Video Tutorials for IT Security or related. Something like khanacademy.org but for IT Security.
Suggestions?
8
votes
5answers
280 views
In what ways do some banks inadequately advise their customers on online security?
I'm looking for specific examples of things such as:
Misleading, but common advice
Advice which has backfired
Advice which is just, quite simply, incorrect
which have been circulated time and time ...
7
votes
8answers
359 views
Topics for SecureCoding course in C
So I was asked to put together a syllabus for a series of courses on the basics of secure coding, for a programming team. Though the time constraints are a bit... constraining, I'm working around ...
7
votes
4answers
330 views
How to convince your boss about importance of IT security
Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?
There are a couple of known good practices in the field of IT security. ...
7
votes
5answers
1k views
Best Security Conferences? [closed]
Not sure if this question is too broad, if it is please let me know, we could probably turn it into a wiki. I'm posting this as a reference for other users.
What would you say are the best ...
7
votes
2answers
209 views
Should a penetration tester have training in ISO 27001/ITIL etc?
I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
6
votes
7answers
5k views
Programming language for network security
I am working as a tester now. I am planning to move to the domain of security such as a CEH or CISSP. But many say that to be a great hacker you need to know at least one programming language well. I ...
6
votes
10answers
453 views
networking and security
I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about ...
6
votes
4answers
656 views
Is Schneier's “Applied Cryptography” current?
I've been recommended Bruce Schneier's 1994 book Applied Cryptography as an introduction to the use and the inner workings of cryptography. Is this book still current and a good introduction?
6
votes
5answers
241 views
What should students learn about security in an introductory programming course?
Some folks have advocated that security should be integrated into computer science coursework, throughout the curriculum. Suppose we are going to add one lecture on security, to a first course on ...
6
votes
2answers
188 views
dealing with small businesses and security issues
I am dealing with a small business that I have no choice right now but to deal with. I do not work for this business but my personal life dictates that I use them right now. I noticed a few months ago ...
6
votes
2answers
239 views
How to explain computer security to low-grade students?
This is my first question here on Security, so please forgive me if I'm in the wrong place for asking this.
I am a computer science teacher currently teaching classes of teenage students age between ...
6
votes
1answer
995 views
SANS training - worth it?
I am a programmer, doing mostly web development now, dealing also with securing the web applications in my line of work. I have reasonable knowledge of security matters, though not always staying ...
5
votes
5answers
452 views
Where should I go from here to be a pentester?
I would like some tips on what I can study to be a better penetration tester. That is what I would like to work towards being, although I have trouble knowing where to start.
I have a decent ...
5
votes
5answers
492 views
Where can I find a mentor/teacher in computer security?
I really enjoy computers - especially security. That's why I went to a school profiled as technical/IT. However, they teach crap. They don't know anything after the release of windows xp/2003. When ...
5
votes
1answer
188 views
What are the good resources for learning Metasploit?
Ok. I'm a newbiw (Script kidde) and I want to learn more about Metasploit. Not for fun, but to understand what exploits are, how they are used, and deployed. I've heard a lot about the Metasploit ...
5
votes
2answers
514 views
Beginner level security for a CS student
I am a final year CS student, and would like to study info sec. Till today, I've been reading infosec mailing lists, some Phrack papers etc., but all in a very casual way.
I am interested in learning ...
5
votes
3answers
226 views
Some good resources on viruses/worms?
I am searching good info on sophisticated viruses/worms. One example would be STUXNET and the very good analysis made by folks from Symantec. Any ideas?
5
votes
2answers
316 views
How do you organize a code review / static analysis report?
Recently I get involved in a security code review.
I found many format string, buffer overflow and dangerous libc function call.
Right now I need to write down a report with all the stuff founded ...
5
votes
3answers
134 views
What policies maximize incident detection (and compromise detection)?
What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
5
votes
1answer
471 views
“Hello World” example of a Buffer Overflow attack in many programming languages
I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used
Ideally (and if ...
5
votes
5answers
273 views
Introduction/refresher course on Windows security
Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.
I am not a newbie programmer, actually have more than 10 years of experience, with a ...
5
votes
2answers
431 views
Should I go for Master of Science by GIAC SANS and what to do with my expiring GSEC cert?
I am now concentrating on my startup which is basically a one-man show.
At the same time, i just received an email from SANS Technology Institute’s (STI) about their exciting new accelerated option ...
4
votes
7answers
320 views
Information Security is becoming more important, but why is it still so difficult to start off in?
For example i have seen countless speachess by the UK goverment on how likely a cyber attack is, if so why do they not offer more incentives for new security professionals.
I find it frustrating as a ...
4
votes
6answers
575 views
Best resources to learn web security attacks? [closed]
Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?
4
votes
4answers
663 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
