So, as it stands I'm a 21 year old recent Bio-Chemistry graduate looking for a path into InfoSec.

Without a background in any computing discipline I assumed that it would be seen as compulsory that I attain a degree in some related field, so I applied to several MS programs in both CS and IS. I have acceptances to several grad. schools among the top 30, and I'm attempting to decipher where I should go from here.

Would it be better to choose a program specifically geared towards IS and get my MS in Information Assurance & Security?

Would it be better to generalize and select a MS in Computer Science program and then have my electives in InfoSec?

Or is pursuing further education not advisable?

  • Welcome to StackExchange. Unfortunately, your question is highly subjective and is difficult to answer as-is. It also falls under the "too localised" rule, since it's unlikely to apply to anyone else. Please see the FAQ for more details. – Polynomial Mar 2 '13 at 16:11

I would be cautious about masters in Computer Science, they tend to be more research oriented building on the basis of an undergrad in the field. Not that they couldn't be helpful, but you'll want to make sure that you have a firm understanding of the material they are going to assume you know prior to starting such a program.

It would probably first be worth picking up something like a good CISSP study guide and read it. InfoSec isn't really all that different from Security in general and while a strong technical foundation is certainly very valuable, just as much or more of the knowledge is about people and how they operate, physical security, general thinking and then some specific details about what strengths and weaknesses are of existing technical systems.

Being such a broad field, I'd recommend looking in to some of the more overview material and that will give you a better idea where your strengths and weaknesses are and then you can work from there to determine what kind of additional training you need.

| improve this answer | |

If you want to attack software and systems, a private business doing pentesting may be more suitable than doing an MSc. However, you need to be at least a good programmer already.

If you want to design/improve systems, an MSc and probably PhD is the way to go. It is hard to advise on a particular university program. Check what kind of courses are offered and what the respective research groups offering those courses are doing for research.

I suppose a well-equipped university should have at least one group doing cryptography, one for embedded (sensor) systems, side-channel attacks, and one for networks/web20.

Check the sizes of these groups. It is not good if the "side-channel lab" is just a 2-man operation of some hardware engineering group. General research groups that do security on the side are usually not very deep in the topic, and the courses will be more superficial, if provided at all.

You may also check their publications list and see if they recently had papers at Tier 1/2 conferences:

http://faculty.cs.tamu.edu/guofei/sec_conf_stat.htm http://icsd.i2r.a-star.edu.sg/staff/jianying/conference-ranking.html

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.