Take the 2-minute tour ×

I am currently just finishing a undergrad computer science degree, but I know very little about computer security.

What are some good resources (aside from this site) to learn the fundamentals of security. I realise that good resources will probably vary depending on specifically what sort of security each is aimed at.

I've looked at this Linux Security HOWTO: http://tldp.org/HOWTO/Security-HOWTO/index.html

The question can be rephrased: If you were forced to employ someone in my situation (solid knowledge algorithms/data structures, a few languages and different programming paradigms and basic Unix knowledge), what would you make them read/learn?

share|improve this question
You may take a look at this topic. –  Sadeq Dousti Nov 13 '10 at 4:27
Again, employ for what position? –  AviD Nov 14 '10 at 2:32
You can start here security.stackexchange.com/questions/486/… –  bretik Nov 22 '10 at 14:01
Is this a dupe of security.stackexchange.com/questions/2226/…;? –  user185 Feb 23 '11 at 10:57
@graham Looks remarkably similar –  Rory Alsop Feb 23 '11 at 23:48

11 Answers 11

That's a tough question to answer, because "Computer Security" is a very broad field--

If you are looking for just general computer security stuff, I would start following Richard Bejtlich, who has authored a couple very good network security & forensic books--But he also deals with the philosophical mindset of computer security--For instance, from the Tao of Network Security Monitoring:


I would also recommend Bruce Schneier, & most of SANS resources.


share|improve this answer

Community side: IRC is your friend, imo. Otherwise I like those:

About written resources, I found extremely useful the security section of the FreeBSD Handbook. Computer Security is an huge landscape - depends on what are you looking for.

share|improve this answer

As you said, it really depends in what field of security you're referring to...
If you're looking for application security information, go straight to OWASP. Start there, lots of places to go after.

share|improve this answer

There are a range of organisations who will not employ directly into security consulting or security audit roles unless you can evidence strong IT experience. This does help to build a more rounded, practical view of security in a real world operational environment, whereas sometimes when I have hired new graduates of security degrees they have required so much training in order to bring their ideas of security down from an 'ideal' but unworkable position to a practical level.

Examples of areas I have most successfully hired from - networking and firewalling (CISCO, Checkpoint, Telecoms etc), Computer Science degrees, Security and Forensics degrees.

And my most useful training for them - on the job with an experienced pro, first in audit roles, then consulting.

share|improve this answer

I highly recommend Ross Anderson's Security Engineering. The first edition is available as PDFs for free.

From Chapter 1:


share|improve this answer

There is a huge variety of books on information security available for free. A simple google would make the deal in case you have the necessary topics!

Hereafter my personal recommendation as a must to enter to that world:

  • How to integrate security in software development lifecycle. You would get the Microsoft SDL (that would consume some of your time to read it and familiarize yourself with each topic separately), Building Security In (e.g. BSIMM...), security requirements, secure programming... With that you should cover (as i referred to the sub topics importance) security testing, fuzz testing, code review, ...

  • On the other hand you would need to learn the technology specific security solutions, like security for html frames..., access control models from the application layer until DBMS, security protocols and why are they used, security for web technologies and for RESTful web services or SOAP based web services.

  • Security properties offered by frameworks and IDEs, .Net framework, ...

Try googling for these, in case you couldn't get useful link, i would be able to provide it for you just leave me a comment.

share|improve this answer

NYU:Poly has their whole security course about pen testing online: Penetration Testing and Vulnerability Analysis

share|improve this answer
Actually, this link was already mentioned in "Linked" topics, that directs to security.stackexchange.com/questions/1/…. –  anonymous Nov 22 '10 at 14:51

The best way to learn is by having fun doing so. Thats why I got fond for "wargames" or hack challenges.

I would check out: http://hackquest.com/

And also:



For video tutorials and lectures I use:


share|improve this answer

Safari Books Online: http://www.safaribooksonline.com/

Amazon's Bestsellers in Computer Security & Encryption: http://www.amazon.com/gp/bestsellers/books/377560011/

share|improve this answer
+1 for mentioning Safari books. I have a membership through my corporation and Im loving it. I would never go back! :) I also have my ipad hooked up to it making it easy to look up information anytime anywhere. –  Chris Andrè Dale Nov 24 '10 at 20:56

Learning how to secure something means you understand, at a deep level, how that thing works and what it's weaknesses are. Risk assessment is also a big part.

I'm sure there are plenty of links to be found to security sites, mailing lists and books, but it really all comes down to understanding the weaknesses of the system and assessing the possible threats.

Generally, the best resource to securing something will be that things manual and your own critical thinking.

share|improve this answer

You've got a lot of suggestions from the generous people at security.stackexchnage. However, I am also sharing one great source to learn about computer security. It is http://opensecuritytraining.info/, the tutorials here will clear most of your basics and you will be all set to move forward.

Other than that I would suggest you to look into the archives of various hacking conferences such as

share|improve this answer

Your Answer


