To learn how to keep things secured, and to do a good job at it, what books should one check out?

  • That depends, is there any regulation that is involved such as HIPAA or PCI compliance? What data will be kept and what basic infrastructure would be involved? Are you just looking for security just on the servers or also on teh other network devices such as workstations, routers, etc.
    – Brad
    Aug 3, 2012 at 18:04
  • No particular compliance, and not any specific infrastructure. I'm more looking for "best practices" rather than "how to." Aug 3, 2012 at 18:16

1 Answer 1


I don't think such a definite set of books exists- there is a lot to security, and everyone on here is going to have a different opinion on what papers and books are superior and inferior. For example, some books cover certain topics excellently but others vaguely. Some are perfect for a certain type of individual, with a specific skill and level, but absolutely trivial and boring for another.

Personally I think you are best researching one specific topic at a time, with a variety of resources that you have picked. So instead of grabbing a suggested, broad, security book and reading it from front to back, pick up several books and resources, and read how they each cover one specific topic. Make your way through topics using an array of resources.

While doing this ensure you remain hands on. You don't want to just read, you want to actually do it yourself. So set up a local server environment and get to work; set up your own experiments and be prepared to break things (recursive: breaking, fixing, securing).

Securing a server also involves securing the applications running on it. There is no point having a super secure server if the main application running is vulnerable to SQL injection and remote file inclusion. That then opens up the available learning content massively. So make sure you remain open. Also remember, even if you take all precautions, you still, sooner or later fail; Keep damage minimisation and mitigation on your mind- limit scope and verify backups.

Digital security is a long, forever changing road.

If you were to provide a bit about yourself: your skills and proficiencies, maybe someone would be able to recommend some starting resources and topics (are you a confident server administrator and/or engineer? / are you aware of the top server/web application vulnerabilities? / What is your experience in digital security? / What type of application and server you are working on? / etc)

Not the answer you're looking for? Browse other questions tagged or ask your own question.