I have been working in web development for a fair amount of time. I am looking at developing in either Python (Django etc.) or PHP. I am new to security. Where do I begin looking? What are basic things I should have in mind? Basically, how do I get started with this? Apart from web related security, what do I go through?
There are so many things to do and read that it's impossible to list them all all here. However, here is a collection of links to questions on this site to get you started:
Security is every where in this connected world. First of all, you should grab some security-related books to read, such as:
The Tangled Web: A Guide to Securing Modern Web Applications
The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws
The Shellcoder's Handbook: Discovering and Exploiting Security Holes
You should constantly update your information against this vast field via forums, Twitter, LinkedIn groups, ...
Last but not least, I think you should keep your enthusiasm, your curiosity in every digital system: how it works, how people interacts with it, how to break security mechanism, ...
If you are going for PHP you might like this great book
It explains the acts that might expose your application and makes it vulnerable.
also you might like the "programing " chapter of this book
its a great start for beginners ,its divided into 4 parts: introduction,programing,networking ,cryptography
Well both of us are surely in the same boat.
I will simply list down a few things which have helped me a lot in my past few months ever since i ventured in the field of security.
http://www.securitytube.net - you will great videos which will help in understanding the theory you read elsewhere
http://www.happyhacker.org - Again a great site for good reading stuff.
Visiting security.stackexchange.com regularly and reading the previous posts has also helped me a lot. It is awesome!!
www.insecure.org - nmap i another great tool which you will find here and may want to look at. The site also offers other great reading stuff.
www.offensive-security.com - you can save this one when you feel you are crossing past the 'beginner' stage. They have a great post on Metaspolit, and they offer professional courses as well.
I did a blog post with a friend (@securityninja) on something similar - http://www.securityninja.co.uk/application-security/random-thoughts-on-education-learning-from-markofu/ - which you might find useful.
Additionally, Robin Wood has recently done some research on this topic. He presented it at BSides London recently and has posted his findings on his blog - http://www.digininja.org/projects/breaking_in_part_1.php.
There's a lot of information so I hope it's of help.
Where do I begin looking?
Start by looking around you. Security is about people dealing with technology. What are the challenges your friends, family, and peers are having with keeping their information secure? What are some solutions to their problems.
What are basic things I should have in mind?
Information has value that we are trying to protect, but it's value is not the same to everyone and protection takes different forms: confidentiality, integrity, availability. Learn what type of information needs what type of protection. Sometimes the protection is legally required (personal, medical, financial, etc).
Basically, how do I get started with this?
Read articles or books on security that interest you. Participate in discussions and forums. If you find an area of interest with like-minded people, you won't be able to stop.
Apart from web related security, what do I go through?
Learn about networking, system administration, risk and mitigation, and most importantly good written and spoken presentation.