Much in the same way compilers has the dragon book, algorithms has the Cormen, and graphics has Foley & van Dam I am wondering what the book on computer security is. Not the "best" book, or the most practical, or the "hacking handbook", but the classic book on the fundamental theoretical concepts behind information security that's been used in classes for generations (or will be, once it's old enough). Is there such a book?

In other words, if information security was cooking, which book would be The Joy Of Cooking? If information security was Scotch, which book would be Michael Jackson's Complete Guide To Single Malt Scotch? If information security books were drills, which would be the Hole-Hawg?

closed as primarily opinion-based by user10211, Rory Alsop Jun 20 '14 at 10:49

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • ash - as per the notice, questions like this aren't answerable - many answers could be right for one person but wrong for others. Sorry. – Rory Alsop Jun 20 '14 at 10:50
  • I think it's answerable because @pacifist gave an answer. I'm not asking for people's opinions. I guess it's hard to understand what I am asking if you don't know the example books I listed. For those books, 100% of people in those fields know those books and probably 98% of professors teaching those subjects have them on their bookshelf. – ash Jun 20 '14 at 11:20
  • pacifist's answer is one right answer, as is executifs; unfortunately there are loads, which makes it not answerable as per Stack Exchange guidelines. We all have these books, and we all have different 'preferred' ones. So what you would get is a list of answers = off topic here. – Rory Alsop Jun 20 '14 at 12:57
  • executifs' wasn't a right answer though. OK, there are two possible outcomes here: loads of answers all for different books, which means there is no answer; or pacifist says "It's Security Engineering and everyone goes "Oh yes, that book is the foundation of any information security education!" and upvotes it and I have my answer. Unfortunately that can't happen if I'm not allowed to ask the question. – ash Jun 20 '14 at 18:49
  • Doesn't need to be any more discussion. Both answers so far are right in their own way. And there are other fills who would argue the case for other books. – Rory Alsop Jun 20 '14 at 20:09

Security is an extremely vast topic... Which part of it exactly do you want to study?

Cryptography? Although it's a bit old, Bruce Schneier's Applied Cryptography gives an excellent introduction to the field. Forensics ? Real Digital Forensics did the trick for me, and I find it extremely practical. Malware analysis? Windows' security mechanisms?

The problem is, many fields in information security don't have a fundamental "theory" (to the best of my knowledge), but are instead very empiric and practical. Unless you make a more specific request, I'm not sure you will be able to find a single book that satisfies you (but other answers may prove me wrong).

  • The example topics I named are equally vast. Just because something is vast doesn't mean there can't be an overview of the fundamentals. I know there may not be a book like this, but I'd think there would be. What about all those security architectures I don't know on the CISSP exam that are named after people? Isn't there a book that collects stuff like that, without being a study guide for the CISSP? In other words, a book that the CISSP exam tries to cover, rather than a book covering the CISSP exam? – ash Jun 20 '14 at 8:58
  • Applied Cryptography is badly flawed. It's successor's successor, Cryptography Engineering is a much more up to date, and much better choice. – Xander Jun 26 '14 at 1:42

I would actually say that there is one, Ross Anderson's security engineering is it, and it's free: http://www.cl.cam.ac.uk/~rja14/book.html https://www.schneier.com/blog/archives/2013/03/ross_andersons_1.html

I also agree with executifs's comment - the books he mentions are the books regarded as core to those disciplines.

Ross Anderson's book has the correct title though for what it is - it gives an overview of what's involved in many areas down to a satisfying level of detail.

Not the answer you're looking for? Browse other questions tagged or ask your own question.