5 ms·

Another poster listed the curriculum. As a security professional from a top software company I am not really impressed. The curriculum is as follows (tech spec

Another poster listed the curriculum. As a security professional from a top software company I am not really impressed. The curriculum is as follows (tech specialization, the others are worse): 1 intro to security 1 intro to policy 1 hands on lab 1 crypto 1 netsec 2 it security choice of (2): basic CS courses (i.e. mobile apps, operating systems) None of that will help you get a job at any company with a serious security org. All of those courses from what I could find are the same introductory level electives you can get in your BS degree in CS. It is not a specialized program, it is more of an introduction to security and CS at the MS level. Things that would help: Client XSS, Authentication / Session Management, Secure client/server architecture, defining access boundaries, phishing / social engineering, red team / blue team setup, automated vulnerability regression tests, SSDL, threat modeling, etc.

sinatra 8y ago
Thank you! Do you recommend a few books or courses that would have better / more relevant coverage for people interested in the space?
ransom1538 8y ago
"Client XSS, Authentication / Session Management, Secure client/server architecture, defining access boundaries, phishing / social engineering, red team / blue team setup, automated vulnerability regression tests, SSDL, threat modeling, etc. " ^ I am in no way trying to be offensive here. But if you are already a programmer, with the exception of "threat modeling" and "regression tests", it seems all those topics combined would take a week to learn?
- detaro 8y ago
  If "learn" is "has seen and memorized a checklist", then maybe. Don't expect people that "learned" like that to be able to do much in practice with that though.
  - 3pt14159 8y ago
    Yeah. Security is best learned after creating software for four or five years. Before that you're not going to have enough of the pieces to think about it creatively. Things turn into "rules-games" where everyone else has to tell you the rules. Also, I think studying data science is underrated for cybersec.
    - FLUX-YOU 8y ago
      >Also, I think studying data science is underrated for cybersec. Can you elaborate? I know a lot of security teams will have large amounts of machine data thrown into ELK or Splunk, but that seems like qualitative data and so there's not a lot of number-crunching to do.
      - time0ut 8y ago
        Things like fraud detection come to mind. Being able to build a model based on previously detected bad actors and then use that model to detect possible additional bad actors is a specialized but useful skill in some contexts.
      - xapata 8y ago
        Statistical anomaly detection is quite valuable.
      - 3pt14159 8y ago
        There's just so many things that are helpful from data science. Graph Analysis => Saw some guys turn the Android codebase into a graph and use that to turn a dozen minor exploits into a chain that gave them root. Pwn2own IIRC. Statistics => Great for detecting anomalies / understanding how to evaluate manipulation of cyber adjacent systems. For example, understanding the beta distribution lets you figure out how someone will game ratings in your app store to beat out legitimate apps with similar sounding ones. And of course all of these things cut both ways: if you're on red team it helps you masquerade more effectively. Recommenders => Obviously useful to understand from attack detection, spam filter evasion, etc. Linguistic analysis => De-anon attackers by the language they use. Figure out automatically which email accounts have been owned by sudden changes in speech usage.
- txcwpalpha 8y ago
  The "already a programmer" thing is quite a misconception here. Security has many topics and domains that have nearly no crossover with being a programmer. It's possible that many people entering this degree program have no past (or future) experience writing code. Anecdotally, at my (one of the largest in the world) security consulting firms that hires from similar degree programs, a very small minority of people have any experience as a programmer, and a similarly small minority of our work involves writing/reading any code.
beambot 8y ago
Your list of "things that would help" are topics that (I imagine!) should be covered in intro to security, netsec, or IT security -- e.g. as 1-week or 2-week sections during the respective courses. Very few of your topics should be dedicated courses.
- dronemallone 8y ago
  Agreed. Those topics are very specific instances of general principles that are usually taught in a security course. What did OP mean by "secure client/server architecture" though? What are the basic/fundamental principles behind it, that are NOT covered in cybersec education?
- deleted 8y ago
  [deleted]
unethical_ban 8y ago
It's my observation that a master's is often a "second field of study" after getting a bachelor's. Whether that should be or not is debatable. But I know people in the field of infosec that have less experience than this, so if someone really gross the content of these courses, I'd hire them.
- ams6110 8y ago
  Yes. When I did my undergrad in CS, the people doing Masters degrees were taking many of the same classes. Different course catalog numbers, but they were sitting in the same room with me, hearing the same lectures, and doing the same homework.
p1necone 8y ago
Your list of topics sounds like what should be covered in security in a software engineering context more so than a computer science context. In computer science I would expect more of a deep dive in to the crypto math stuff.
nkozyra 8y ago
Some of that is definitely covered in the curriculum, at least in the classes I took at GT that are part of this.
- JamesBarney 8y ago
  Was it covered in a theoretical sense where you took quizzes on it or in a more hands on way where you find xss exploits and exploiting them?
  - nkozyra 8y ago
    My focus wasn't security, but the classes I took were hands on projects
  - petrbela 8y ago
    Intro to Information Security, for example, has four hands-on projects: 1. Exploit a buffer overflow in a C program 2. Use Cuckoo to understand a malware attack 3. Implement CBC encryption algorithm and a brute-force algorithm to crack it 4. Demonstrate an XSRF, XSS and SQL injection attack Remember this is an intro course and there are about 2-3 weeks per project so you won't be an expert but I'd say it makes you aware of some of the basic security attacks and how to prevent them.
  - nostrebored 8y ago
    Georgia Tech biases heavily towards hands on project design. It was also rated the worst school in terms of work life balance while I was there. Grad level courses will easily suck up a substantial portion of your life, even if the content seems 'simple.'
rikelmens 8y ago
It would be great if you could share a list of recommended readings for each of the things you posted. Thanks in advance.
bogomipz 8y ago
>"Another poster listed the curriculum" I'm not sure why you are just reposting what someone else wrote, the course and curriculum are linked to in the second sentence of the article. It's far more solid than your incredibly spartan summary: https://pe.gatech.edu/degrees/cybersecurity https://pe.gatech.edu/degrees/cybersecurity Your list of "things that would help" are likely found in: "Introduction to Information Security (CS 6035) A full spectrum of information security: threats, software vulnerabilities, programming for malice, basic cryptography, operating systems protections, network security, privacy, data mining, computer crime."
littlesheephtpt 8y ago
I disagree, every year I go over a hundred of new-grads resumes from top schools and interview for dozens of security engineer and researcher positions. My basic impression is that no undergrad program has any worthwhile undergrad-level security emphasis. I would definitely give someone with such a masters degree a second or third look.
sandworm101 8y ago
As this is a masters-level course, arguably readying people for management, I would add a course or two on compliance. Too many security pros know how to secure a system but know nothing about security standards. If you cannot explain how what you have done complies with various standards, all your effort will be torn down. A course on documentation would also be prudent. Knowing the difference between policies, standards, and procedures will help you in any interview for positions above entry level. Knowing qualitative from quantitative, and being able to talk about abstract security theory, would be good too. And some law. Some basic course so you can talk about negligence and liability without sounding like a wikipedia page.
deleted 8y ago
[deleted]
Tsagadai 8y ago
I'm a grad of the OMSCS program. The "netsec" subject covered all of the "things that would help" and some in detail with practical projects.
peterwwillis 8y ago
> None of that will help you get a job at any company with a serious security org Most of the jobs are with non-serious orgs. But yeah, paying $10k to get a basic bootcamp on security probably isn't going to inspire tons of confidence by employers.
vzcx 8y ago
As non-degreed developer who is looking to transition to security work, I was initially excited to see this program but had a similar reaction after looking at the curriculum. Potential gems on the list might be the OS or networking course if they are run something like MIT's 6.828 with lots of lab coding and perhaps a bit of hand-holding, but if you can just clone last semester's 6.828 repo and get osdev'ing, why drop 10k to spend most of your time on courses that look like yawn central? I think what I really wanted to see was a lab-focused curriculum for aspiring vulnerability researchers, so perhaps I was bound to be disappointed.
- gaius 8y ago
  a lab-focused curriculum for aspiring vulnerability researchers A MS is an academic degree so of course it will be heavy on the theory, and you will mainly be expected to do practical work independently on top. Same as an undergraduate degree actually, at least a good one. That stuff you call “yawn central” is the principles that will last your entire career, the stuff you learn in the lab will be obsolete in a few years.
Trump2020MAGA 8y ago
Do you know of any universities that have a masters degree with these courses?

sinatra 8y ago

Thank you! Do you recommend a few books or courses that would have better / more relevant coverage for people interested in the space?

ransom1538 8y ago

"Client XSS, Authentication / Session Management, Secure client/server architecture, defining access boundaries, phishing / social engineering, red team / blue team setup, automated vulnerability regression tests, SSDL, threat modeling, etc. " ^ I am in no way trying to be offensive here. But if you are already a programmer, with the exception of "threat modeling" and "regression tests", it seems all those topics combined would take a week to learn?

detaro 8y ago
If "learn" is "has seen and memorized a checklist", then maybe. Don't expect people that "learned" like that to be able to do much in practice with that though.
- 3pt14159 8y ago
  Yeah. Security is best learned after creating software for four or five years. Before that you're not going to have enough of the pieces to think about it creatively. Things turn into "rules-games" where everyone else has to tell you the rules. Also, I think studying data science is underrated for cybersec.
  - FLUX-YOU 8y ago
    >Also, I think studying data science is underrated for cybersec. Can you elaborate? I know a lot of security teams will have large amounts of machine data thrown into ELK or Splunk, but that seems like qualitative data and so there's not a lot of number-crunching to do.
    - time0ut 8y ago
      Things like fraud detection come to mind. Being able to build a model based on previously detected bad actors and then use that model to detect possible additional bad actors is a specialized but useful skill in some contexts.
    - xapata 8y ago
      Statistical anomaly detection is quite valuable.
    - 3pt14159 8y ago
      There's just so many things that are helpful from data science. Graph Analysis => Saw some guys turn the Android codebase into a graph and use that to turn a dozen minor exploits into a chain that gave them root. Pwn2own IIRC. Statistics => Great for detecting anomalies / understanding how to evaluate manipulation of cyber adjacent systems. For example, understanding the beta distribution lets you figure out how someone will game ratings in your app store to beat out legitimate apps with similar sounding ones. And of course all of these things cut both ways: if you're on red team it helps you masquerade more effectively. Recommenders => Obviously useful to understand from attack detection, spam filter evasion, etc. Linguistic analysis => De-anon attackers by the language they use. Figure out automatically which email accounts have been owned by sudden changes in speech usage.
txcwpalpha 8y ago
The "already a programmer" thing is quite a misconception here. Security has many topics and domains that have nearly no crossover with being a programmer. It's possible that many people entering this degree program have no past (or future) experience writing code. Anecdotally, at my (one of the largest in the world) security consulting firms that hires from similar degree programs, a very small minority of people have any experience as a programmer, and a similarly small minority of our work involves writing/reading any code.

beambot 8y ago

Your list of "things that would help" are topics that (I imagine!) should be covered in intro to security, netsec, or IT security -- e.g. as 1-week or 2-week sections during the respective courses. Very few of your topics should be dedicated courses.

dronemallone 8y ago
Agreed. Those topics are very specific instances of general principles that are usually taught in a security course. What did OP mean by "secure client/server architecture" though? What are the basic/fundamental principles behind it, that are NOT covered in cybersec education?
deleted 8y ago
[deleted]

unethical_ban 8y ago

It's my observation that a master's is often a "second field of study" after getting a bachelor's. Whether that should be or not is debatable. But I know people in the field of infosec that have less experience than this, so if someone really gross the content of these courses, I'd hire them.

ams6110 8y ago
Yes. When I did my undergrad in CS, the people doing Masters degrees were taking many of the same classes. Different course catalog numbers, but they were sitting in the same room with me, hearing the same lectures, and doing the same homework.

p1necone 8y ago

Your list of topics sounds like what should be covered in security in a software engineering context more so than a computer science context. In computer science I would expect more of a deep dive in to the crypto math stuff.

nkozyra 8y ago

Some of that is definitely covered in the curriculum, at least in the classes I took at GT that are part of this.

JamesBarney 8y ago
Was it covered in a theoretical sense where you took quizzes on it or in a more hands on way where you find xss exploits and exploiting them?
- nkozyra 8y ago
  My focus wasn't security, but the classes I took were hands on projects
- petrbela 8y ago
  Intro to Information Security, for example, has four hands-on projects: 1. Exploit a buffer overflow in a C program 2. Use Cuckoo to understand a malware attack 3. Implement CBC encryption algorithm and a brute-force algorithm to crack it 4. Demonstrate an XSRF, XSS and SQL injection attack Remember this is an intro course and there are about 2-3 weeks per project so you won't be an expert but I'd say it makes you aware of some of the basic security attacks and how to prevent them.
- nostrebored 8y ago
  Georgia Tech biases heavily towards hands on project design. It was also rated the worst school in terms of work life balance while I was there. Grad level courses will easily suck up a substantial portion of your life, even if the content seems 'simple.'

rikelmens 8y ago

It would be great if you could share a list of recommended readings for each of the things you posted. Thanks in advance.

bogomipz 8y ago

>"Another poster listed the curriculum" I'm not sure why you are just reposting what someone else wrote, the course and curriculum are linked to in the second sentence of the article. It's far more solid than your incredibly spartan summary: https://pe.gatech.edu/degrees/cybersecurity https://pe.gatech.edu/degrees/cybersecurity Your list of "things that would help" are likely found in: "Introduction to Information Security (CS 6035) A full spectrum of information security: threats, software vulnerabilities, programming for malice, basic cryptography, operating systems protections, network security, privacy, data mining, computer crime."

littlesheephtpt 8y ago

I disagree, every year I go over a hundred of new-grads resumes from top schools and interview for dozens of security engineer and researcher positions. My basic impression is that no undergrad program has any worthwhile undergrad-level security emphasis. I would definitely give someone with such a masters degree a second or third look.

sandworm101 8y ago

As this is a masters-level course, arguably readying people for management, I would add a course or two on compliance. Too many security pros know how to secure a system but know nothing about security standards. If you cannot explain how what you have done complies with various standards, all your effort will be torn down. A course on documentation would also be prudent. Knowing the difference between policies, standards, and procedures will help you in any interview for positions above entry level. Knowing qualitative from quantitative, and being able to talk about abstract security theory, would be good too. And some law. Some basic course so you can talk about negligence and liability without sounding like a wikipedia page.

deleted 8y ago

[deleted]

Tsagadai 8y ago

I'm a grad of the OMSCS program. The "netsec" subject covered all of the "things that would help" and some in detail with practical projects.

peterwwillis 8y ago

> None of that will help you get a job at any company with a serious security org Most of the jobs are with non-serious orgs. But yeah, paying $10k to get a basic bootcamp on security probably isn't going to inspire tons of confidence by employers.

vzcx 8y ago

As non-degreed developer who is looking to transition to security work, I was initially excited to see this program but had a similar reaction after looking at the curriculum. Potential gems on the list might be the OS or networking course if they are run something like MIT's 6.828 with lots of lab coding and perhaps a bit of hand-holding, but if you can just clone last semester's 6.828 repo and get osdev'ing, why drop 10k to spend most of your time on courses that look like yawn central? I think what I really wanted to see was a lab-focused curriculum for aspiring vulnerability researchers, so perhaps I was bound to be disappointed.

gaius 8y ago
a lab-focused curriculum for aspiring vulnerability researchers A MS is an academic degree so of course it will be heavy on the theory, and you will mainly be expected to do practical work independently on top. Same as an undergraduate degree actually, at least a good one. That stuff you call “yawn central” is the principles that will last your entire career, the stuff you learn in the lab will be obsolete in a few years.

Trump2020MAGA 8y ago

Do you know of any universities that have a masters degree with these courses?