I acquired it by just doing it over the years I've been programming/engineering. When I was younger I wanted to be a "hacker" (the kind that does malicious stuf

I acquired it by just doing it over the years I've been programming/engineering. When I was younger I wanted to be a "hacker" (the kind that does malicious stuff and ends up locked in federal prison), so I started using tools like backtrack to see if I could break websites, and it turned out I could. I just read things like OWASP, and I currently work for a security company that specializes in financial institutions (AKA banks, credit unions etc) so I acquire knowledge on the job as well. As for books, I found Security Strategy: From Requirements to Reality to be really good, but I haven't really read too many books on this subject to be honest. Certifications are usually cheap and no good, so I don't recommend those. I recommend learning about communication protocols though because if you understand those, you can figure out attacks that may happen just by knowing how they work. As well, there are applications like Webgoat that allow you to download them and they are full of security flaws so you can kind of learn from that. There are guides to teach you how to hack webgoat out there. The key to great info sec is thinking like a hacker, and you acquire by hacking websites (preferably webgoat/your own).