For those of you who don't know any developers and/or didn't go to MIT, The Structure and Interpretation of Computer Programs is the Canonical reference on it's title subject. It is often used as the text in begining comp sci classes.

What, if anything, is the equivalent book in information security (please don't respond with anything that contains CISSP in the title)

Edit: As I responded below, I'm really looking more for a book (or collection of books) to give to neophytes (think college intern) to help them achieve the correct mindset. You may have noticed we don't really think about the world the same way most people do...

closed as off-topic by AviD Dec 29 '14 at 12:45

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.


To add to some other answers as people have mentioned there's a lot of different areas to security and they're not all suited to book-based learning. That said you could look at Security Engineering by Ross Anderson. This is what popped into my head first when you said you're looking for a security equivalent to SICP.

It's somewhat academic in tone, but has good coverage of a lot of the fundamental issues in security.

  • I think "somewhat academic in tone" is exactly what is needed here. – devnul3 Dec 13 '11 at 17:02

I recommend Bruce Schneiers Secrets and Lies, which I read recently. It's a good introduction, but not the same way SICP is an introduction to programming. It does a good job with teaching mentality though.


Your question is too broad in scope for an answer. 'Security' covers such a vast scope. Network security, OS security, application security, device security, physical security, human security. These are all topics that an IT security professional needs to have experience and knowledge in, and there can be no single point of reference to spring from.

Sources like that certification, which I will not name, actually cover all those areas, although I am not trying to promote that certification as the fundamental and foundational body of knowledge.


Security doesn't have a bible. Security discussion stems from insecure practices, and those are often dependent upon the problem at hand. Because most issues today were minor or not critical a decade ago, there isn't a solid published pragma. The field is just starting to really mature.

Without the concrete truths of computer science, developing such a thing would be more challenging.

With that said, I've been really happy with the collection of knowledge around this site over the past year. If I were to try writing such a thing, Security.SE would be my starting point. With that said, these are the two bullet points that I feel you should carry at a minimum:

  • Security is a process
  • Security is a mindset
  • Your second bullet is sort of what I was getting after with my (apparently badly-worded) question: Is there some book or collection of books which we can give to college students/new practitioners to teach them to think like we do? – devnul3 Dec 7 '11 at 21:20
  • @devnul3 Given that certain mindsets seem unteachable, I think it would be hard. Security issues in code are mistakes. Building redundant layers for nuclear reactor parts failure and for code failure is the same task -- anticipate likely abuses and plan for them in advance. We still manage to cause nuclear reactor failures. – Jeff Ferland Dec 7 '11 at 21:25

Written materials are possibly the least suited media to encourage a mindset which needs to think 'outside the box' (to use a horrible phrase.) When attackers are looking at any way to get in, having a structured way to think imposed upon you as a defender is not good.

Interestingly, of the books I would recommend, most are not security books, but top of my list would have to be Cory Doctorow's Little Brother which you can get for free download at that link.

If you think any of it is unrealistic, then I would say you are not paranoid enough, or aware enough of what can be done. It focuses heavily on personal freedom and privacy, but the implications are essentially in the security space.

Additionally, encouraging students to carry out their own Mythbusters work also helps with a mindset that questions and tries to break/analyse anything and everything.

Not the answer you're looking for? Browse other questions tagged or ask your own question.