Tag Info

Hot answers tagged

17

One of the things I've been most impressed by in the last few years is the new focus on security as being a balance between cost and risk. A security solution should not be implemented if the cost exceeds the risk of exploit, and both costs and risks can be hard to diagnose. The thing I like most about this core concept is that it basically mandates the ...


14

For Reverse Engineering: The University of Helsinki in collaboration with F-Secure offer a course titled Malware Analysis and Antivirus Technologies which has the curriculum available online. For Secure Coding: CERT is always a good reference, especially for C & C++. They have a Secure Coding in C and C++ course at SEI @ CMU.


9

Well I certainly can tell my share of the "student ethos" because I too did not care (or did not care enough) about security. Add the fact that I was a bit more involved into security than my student friends, you can tell where this is going. The main problem I had was simply that at school, you are told how stuff works and how you ought to do it ...


8

I haven't taken the course, but I've heard a lot of good things about the OCSP certification: http://www.offensive-security.com/information-security-certifications/


7

A few years ago, I helped set up (via the local branch there of my then-company) a similar course at the University of Amsterdam... but I really don't have any current details, though you should be able to look that up. The IDC in Israel has a very good program for infosec - http://portal.idc.ac.il/en/schools/cs/progs/ugrad/Pages/securityintheNetEra.aspx. ...


7

Usually a presentation from the Security Response Team of a company captures the audience whether it is made out of students, managements or developers. It has proven to be quite efficient (it was based on an informal initiative) in telling different stories. Some of these stories focused on some angry developers left back doors, others on some innocent ...


6

SANS offer some courses relating to your areas that I have heard good things about. I suggest them because they have a good break down of the topics they cover that might give you some good ideas. Secure Coding in Java/JEE: Developing Defensible Applications Reverse-Engineering Malware: Malware Analysis Tools and Techniques


6

Your lack of a master's degree won't make any difference, but your lack of any relevant work experience will kill you (unless you've got a few years working in IT security that you've not mentioned). Before you can work as a consultant in any field, you need to be able to demonstrate a track record of proven achievement, not just academic study.


5

Part of the problem is that security is pervasive: studying "security" on its own barely makes sense. You have to study security in context. Contrast with "databases", where it makes sense to teach a semester course on the topic. I don't mean to say that a semester course on security is bad, just that it is insufficient. Most of the courses in the computer ...


5

The University of Pisa offered a course on "Secure Software Development" a year ago. You can download all the lectures and resources from the official page (it's in Italian, so maybe you'll need Google Translate).


4

Have you taken a look at MIT's OpenCourseWare? After a quick search I found a course on Network and Computer Security and Computer Systems Architecture (might be useful for the Reverse Engineering part). You can also try http://academicearth.org/lectures/search/security/ and http://videolectures.net/site/search/?q=security.


4

I don't share your premise that students don't want to hear about security. I teach an undergraduate computer security course. It is one of the most popular courses in our computer science department (not the most popular, but up there). One thing to understand is that most colleges/universities are interested in teaching concepts and principles that will ...


4

I think the best way to get people thinking of security as a real thing rather than abstract is to teach the real basic principals, divorced from computers. Start with physical security and the differences between that and computer security. People dismiss security because so much of it is security theater: lockout after 3 failed attempts, physical ...


4

My best results have been in hiring from problem solving disciplines or areas. People who are old school hackers (in the original meaning of the term) who like to build, tweak, understand and really grok anything, such as hardware, cars, plumbing, electronics etc have always scored well in my book. I have also noticed a strong correlation with rock music, ...


4

I think both are important. It's becoming more common for employers to require an undergrad degree for many positions. Fundamentally, if you don't have an undergrad degree, your ability to apply to positions will be limited. For example, if you ever want to consider working for the Big 4, you'd have to be very much in demand to get past their screening ...


4

My apologies as I don't have enough reputation to comment yet, so I'm forced to create a new answer. jplyle said "Experience is experience, regardless of whether you get it before or after a degree." I would caution you that this isn't necessarily correct; as a techie, I would recognize any experience and evaluate how relevant it was. I delayed my college ...


4

So the underlying question that I see here is: "How do you protect against insider threats?" As I see it, there are two parts to the answer. One is that you protect against insider threats the same way that you protect against external threats, and the other part is that to some degree, you can't. Remember, security is about risk mitigation and ...


4

I've been involved with this type of situation for the past several years. Here's what I teach and focus on. For each topic. Lecture and technical details must be accompanied by either some kind of demo or some kind of hands on exercise. If the demo isn't flashy then it should be an exercise. This stuff is dense. I start every year with 30+ students in the ...


3

You do always have the option of going back to study later on in your career, should you decide that it would be worthwhile. Experience is experience, regardless of whether you get it before or after a degree. I am involved in teaching MSc courses in software engineering to people with industrial experience. Most students already have a BSc in a related ...


3

Microsoft Research: A large scale study on password habits http://research.microsoft.com/apps/pubs/?id=74164 Or google "password user habits" for examples.


3

Stanford University offers an online set of short courses in software security, leading to a Certificate in Advanced Computer Security. The program includes an introductory course on secure software development, and short courses in secure protocols and cryptography, web security, and so on.


3

This course I took at UCSD is similar and very useful https://cseweb.ucsd.edu/classes/sp10/cse127/


3

I think your best bet is to build your own master's - I don't know of any programs with that specific focus. My strategy would be to hunt down universities that are strong in both Info Security and Software Engineering, and then work out a program with your adviser that combines the two. I could be closed minded, but IMO, you're not going to get enough ...


3

If you don't like academia, then I certainly wouldn't recommend it for you. You do not need to have a degree to do well in this field. You just need to compensate a lack of degree somehow. Work experience and certifications will be more than enough to prove to employers that you know what you are doing. This is a very hands-on field, so I think you'll learn ...


2

A fresh grad will not have experience and is highly unlikely to have much domain specific knowledge. The key measurable attributes you're looking for will therefore be cognitive - problem solving styles and the ability to learn from fragmented or disorganised information sources. Provided you're willing to go the psychometrics route that is. On the ...


2

I am trying to define a syllabus for "Secure Programming" course. In my search, I found the course outline provided by Cyber Defense Institute so complete and useful. See the following link http://www.cyberdefenseinstitute.net/courses/secureprogramming/secureprogramming.html#attachment. Just finding some good textbooks for preparing the content of such a ...


2

The Aspect Security courses appear to have the best content. I don't think too many university programs can match what they have done, but the http://pentest.cryptocity.net one mentioned by Ams in these comments is definitely better than most.


2

Boston University Looks like it has what you are looking for. http://www.bu.edu/online/programs/certificate-programs/digital-forensics.html Also Champlain College has a program as well. http://www.champlain.edu/Graduate-Studies/Programs/Master-of-Science-in-Digital-Forensic-Management.html



Only top voted, non community-wiki answers of a minimum length are eligible