Ask HN: How can I learn computer security?

Cyber pro here - 5 years doing IV&V testing, 15 years as Fed, State and Local contractor, now a firewall admin at a major U.S. uni. I got an NSA accredited (https://www.nsa.gov/resources/educators/centers-academic-exc...) Master's in IT with a specialization in security. While the degree got my foot in the door (I have a BA in Arts - but have been messing around with computers since the early 80's - plus a lot of self taught stuff) - I've found that a ton of side reading (anything related to the subject - I spent a lot of time on the RFCs - that stuff I use every day)), looking at PCAPs to understand the protocols and reading case studies are the best way to hone the craft.

For a while I was doing Governance, Risk and Compliance (GRC) work, but have always loved being a network security engineer, so I went back to that.

Also - I have a CISSP, which opens a lot of doors. I know that it is being knocked a bit nowadays, and there are certainly a some who are test knowledgeable but no hands-on, common sense experience. I still find it valuable enough to maintain.

Set up a lab - 2-4 computers and a switch should do (you could virtualize some/all of it) and work on all aspects of the TCP/IP stack if you're interested in netsec.

If appsec is your thing, spend a lot of time looking at good and bad code, plus reading on-line of good and bad appsec.

IF GRC is up your alley - read NIST 800-53, HIPPA, PCI-DSS, SANS Top 20 and GDPR - to understand the full breadth of controls and risk mitigation.

As far as data science python and pandas are all over the industry, R not so much. There is a big push for ML/AI work, but it might be snake-oil, time will tell. I use a lot of python and pandas for log and flow analysis.

Also - learn Linux CLI; grep, sed and awk can save your butt in most situations. Gray beard stuff will come later.

Good luck!

Security fundamentally is just "the art and science of how things work". Breaches in security are caused by malicious actors finding vulnerabilities in trusted systems, such as when Chinese webcams shipped with default credentials which made it trivial for the Mirai botnet to take them over and acquire so many devices that it could DDoS Dyn.

Towards that end, just about anything you learn can be applied in some way towards security. The conventional recommendations others have made will get your foot in the door, but ultimately security is a lifestyle of never-ending learning and imaginative reasoning about systems.

So to directly answer your questions, yes, there are links between data science and security (others have mentioned its use in things like malware research, but going the other way it's also important to store your data securely to prevent theft, destruction, or tampering) and you can learn something about information security pretty much anywhere in-depth information about computers is taught. Which information is relevant to your interests will just depend on which aspect of security is of interest to you.

This is on of my favourites.

* It is neatly packaged, wonderful UX and a little sweetening of humour that makes it palatable to the layman

* It gives code examples that provide a little bit more in-depth exploration for the enthusiastic or aspirational novice

* It has a nice structure such that single exploits can be shared. For example, after a client of ours was hacked via a SQL injection on their website, we were able to show them the SQL injection exercises to demystify the topic a little bit and to make it seem less intimidating

* It's a great go-to starter. When I go to schools for careers fairs, I always give this link out to kids who are interested in security work.

I think it's pretty risky to try to categorize all infosec people into one ranking.. But I will say most folks I bump into are not writing code for maintainability, or necessarily efficiency. Most of us stick with GEMO (good enough move on). thst being said, there are always outliers

Get involved in an active community full of security professionals and learn hands-on helping to secure open source projects.

There is no replacement for mentorship and getting your hands dirty with real world systems.

I will now shamelessly plug the community I learned the most from: https://hashbang.sh