5 ms·

Can you recommend resources to learn security? Passed 3 security modules at my university and it feels like I know not much about secure engineering.

austincheney 5y ago
Study first for the Security+ exam. That is the entry level security certification. It is much harder now than it used to be. You can find a lot of books and study material about it online. The gold standard is still CISSP for the corporate world. It is more of a managerial standard. The best study guide is the official course book: https://www.amazon.com/Certified-Information-Security-Professional-Official-ebook/dp/B07CG86947/ref=mp_s_a_1_4?dchild=1&keywords=cissp+coursebook&qid=1619696728&sr=8-4 https://www.amazon.com/Certified-Information-Security-Profes... https://en.m.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional https://en.m.wikipedia.org/wiki/Certified_Information_System... The standard most prized by government and security researchers is GIAC from Sans. https://en.m.wikipedia.org/wiki/Global_Information_Assurance_Certification https://en.m.wikipedia.org/wiki/Global_Information_Assurance... To take the CISSP you have to apply for the exam because there are prerequisite criteria and the exam costs $700. Even still it only has around a 60% pass rate. The GIAC tests are supposed to be much harder and are extremely expensive. I passed the CISSP but have never taken any of the GIAC tests.
- mhluongo 5y ago
  They asked for learning resources, not paid certifications most of us ignore on CVs.
  - austincheney 5y ago
    That’s because you are a developer and not a security manager.
    - not1ofU 5y ago
      https://www.youtube.com/watch?v=ZdGrC9S4PYA https://www.youtube.com/watch?v=ZdGrC9S4PYA
    - bawolff 5y ago
      CISSP has a somewhat positive reputation, but lots of the other certs are basically negative signal on a resume. There's lots of different types of security stuff. If you're interested in the more risk management corporate side, looking at study material for certs like CISSP can be useful (but use it as a starting point of things to learn, dont follow blindly). If you want to learn crypto, that's not the path i would reccomend.
      - austincheney 5y ago
        The software industry does not value certifications... at all. The networking and security industries, on the other hand, require them. Attaining those jobs/skills from the perspective of writing software is the surest way to waste your time and accomplish nothing.
    - mhluongo 5y ago
      The ask was "secure engineering", yeah? The auditors and pentesters we hire have never presented me with their certificates ¯\_(ツ)_/¯ > That’s because you are a developer and not a security manager These days, I'm neither.. but I am a founder in a security-critical space.
not1ofU 5y ago
For CISSP specifically, search for anything by "Shon Harris" Here are a collection of links that I have, YMMV (theres probably a some overlap in these links): https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYEqNB01EDbCjLy https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYE... https://simonowens157.gitlab.io/cissp/ https://simonowens157.gitlab.io/cissp/ https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkUUId6PKW0fpJdBRJO5MFQ8VM https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkU... https://github.com/ericagleaton/CISSP-2 https://github.com/ericagleaton/CISSP-2 https://github.com/gatlindada/cissp-mind-map https://github.com/gatlindada/cissp-mind-map https://github.com/TheRealBenForce/cissp-mnemonics https://github.com/TheRealBenForce/cissp-mnemonics https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJXGqyHGb0Xsbr https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJ... https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeEFEGJTeDVGr4X https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeE... https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZHKcqXZUIdXqZI https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZH... If you have access to linkedin learning, there are a number of decent resources there also. EDIT: unrelated to ^, Checkout youtuber "Ippsec" - he does hack the box challenges (retired boxes).
- not1ofU 5y ago
  EDIT 2: This is also really great, very recent talk. https://www.youtube.com/watch?v=v1Qt_YYtBoM https://www.youtube.com/watch?v=v1Qt_YYtBoM Speakers Site and slides used for ^ https://momjian.us/main/writings/crypto.pdf https://momjian.us/main/writings/crypto.pdf For those who dont want to click on PDF (Good stuff) link to site: https://momjian.us/main/ https://momjian.us/main/ Bruce Momjian is a legend.
q3k 5y ago
For cryptographic primitives, some of the theory behind them, their practical use and what can go wrong when you fuck things up, 'Serious Cryptography' (https://nostarch.com/seriouscrypto https://nostarch.com/seriouscrypto) is a good book.
bawolff 5y ago
"Security" is a broad concept encompassing many things. You might want to figure out what you want to learn. If you want to learn more about crypto, there's various books (not sure how up to date , but https://www.goodreads.com/book/show/7602360-cryptography-engineering https://www.goodreads.com/book/show/7602360-cryptography-eng... is a good introduction) https://cryptopals.com/ https://cryptopals.com/ is also good if you like hands on.

austincheney 5y ago

Study first for the Security+ exam. That is the entry level security certification. It is much harder now than it used to be. You can find a lot of books and study material about it online. The gold standard is still CISSP for the corporate world. It is more of a managerial standard. The best study guide is the official course book: https://www.amazon.com/Certified-Information-Security-Professional-Official-ebook/dp/B07CG86947/ref=mp_s_a_1_4?dchild=1&keywords=cissp+coursebook&qid=1619696728&sr=8-4 https://www.amazon.com/Certified-Information-Security-Profes... https://en.m.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional https://en.m.wikipedia.org/wiki/Certified_Information_System... The standard most prized by government and security researchers is GIAC from Sans. https://en.m.wikipedia.org/wiki/Global_Information_Assurance_Certification https://en.m.wikipedia.org/wiki/Global_Information_Assurance... To take the CISSP you have to apply for the exam because there are prerequisite criteria and the exam costs $700. Even still it only has around a 60% pass rate. The GIAC tests are supposed to be much harder and are extremely expensive. I passed the CISSP but have never taken any of the GIAC tests.

mhluongo 5y ago
They asked for learning resources, not paid certifications most of us ignore on CVs.
- austincheney 5y ago
  That’s because you are a developer and not a security manager.
  - not1ofU 5y ago
    https://www.youtube.com/watch?v=ZdGrC9S4PYA https://www.youtube.com/watch?v=ZdGrC9S4PYA
  - bawolff 5y ago
    CISSP has a somewhat positive reputation, but lots of the other certs are basically negative signal on a resume. There's lots of different types of security stuff. If you're interested in the more risk management corporate side, looking at study material for certs like CISSP can be useful (but use it as a starting point of things to learn, dont follow blindly). If you want to learn crypto, that's not the path i would reccomend.
    - austincheney 5y ago
      The software industry does not value certifications... at all. The networking and security industries, on the other hand, require them. Attaining those jobs/skills from the perspective of writing software is the surest way to waste your time and accomplish nothing.
  - mhluongo 5y ago
    The ask was "secure engineering", yeah? The auditors and pentesters we hire have never presented me with their certificates ¯\_(ツ)_/¯ > That’s because you are a developer and not a security manager These days, I'm neither.. but I am a founder in a security-critical space.

not1ofU 5y ago

For CISSP specifically, search for anything by "Shon Harris" Here are a collection of links that I have, YMMV (theres probably a some overlap in these links): https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYEqNB01EDbCjLy https://www.youtube.com/playlist?list=PLOM5uDrM2ZKt0ndd-bOYE... https://simonowens157.gitlab.io/cissp/ https://simonowens157.gitlab.io/cissp/ https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkUUId6PKW0fpJdBRJO5MFQ8VM https://www.youtube.com/watch?v=JWqd_qaR81g&list=PLEiEAq2VkU... https://github.com/ericagleaton/CISSP-2 https://github.com/ericagleaton/CISSP-2 https://github.com/gatlindada/cissp-mind-map https://github.com/gatlindada/cissp-mind-map https://github.com/TheRealBenForce/cissp-mnemonics https://github.com/TheRealBenForce/cissp-mnemonics https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJXGqyHGb0Xsbr https://www.youtube.com/playlist?list=PLIVIIjsKiaM8Gtb4oJYqJ... https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeEFEGJTeDVGr4X https://www.youtube.com/playlist?list=PL8qqAEgqfCHCKNn92SLeE... https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZHKcqXZUIdXqZI https://www.youtube.com/playlist?list=PLX1YKQDEsO8B8bevQuTZH... If you have access to linkedin learning, there are a number of decent resources there also. EDIT: unrelated to ^, Checkout youtuber "Ippsec" - he does hack the box challenges (retired boxes).

not1ofU 5y ago
EDIT 2: This is also really great, very recent talk. https://www.youtube.com/watch?v=v1Qt_YYtBoM https://www.youtube.com/watch?v=v1Qt_YYtBoM Speakers Site and slides used for ^ https://momjian.us/main/writings/crypto.pdf https://momjian.us/main/writings/crypto.pdf For those who dont want to click on PDF (Good stuff) link to site: https://momjian.us/main/ https://momjian.us/main/ Bruce Momjian is a legend.

q3k 5y ago

For cryptographic primitives, some of the theory behind them, their practical use and what can go wrong when you fuck things up, 'Serious Cryptography' (https://nostarch.com/seriouscrypto https://nostarch.com/seriouscrypto) is a good book.

bawolff 5y ago

"Security" is a broad concept encompassing many things. You might want to figure out what you want to learn. If you want to learn more about crypto, there's various books (not sure how up to date , but https://www.goodreads.com/book/show/7602360-cryptography-engineering https://www.goodreads.com/book/show/7602360-cryptography-eng... is a good introduction) https://cryptopals.com/ https://cryptopals.com/ is also good if you like hands on.