Ask HN: How can I learn computer security?

One question I have along with the very good question from the OP, do larger companies and governments actually care about security, or are they more interested in doing the proper dance and checking the right boxes to not be held responsible when they're hacked?

It seems irrational to want to learn how to secure systems when their owners don't care about it (and won't pay to secure them) if the risk can be transferred to other parties. I'm sure there's a few organizations that care if their data are stolen, but by and large it's a cost center, and treated accordingly in my experience.

If you want to get a really deep understanding, study computer science (e.g. bachelor/master) [1], then specialize by taking all security courses that are offered. Not only will you get a deep understanding of the topic, you will build on solid fundamentals, as well as have people (professors, assistants, trainers) who you can ask anything.

[1] Of course, you can this only freely in a country that remotely cares about the education of its citizens (e.g. most European countries, where you can go to university for a hew hundred Euros per year). Otherwise, the risk of a huge debt is probably not worth it.

Let me tell you one thing, it's going to be tough. Cyber security is one of the fields of IT that requires the most deep knowledge of how computers and networks work. So, be aware of that. It's like, when someone is asking how to build a game, and the first answer is: learn a lot about Math and Physics. This is the same thing.

Recommended path:

1. CS Basics (concepts) Conceptually understand how computers work, how interpreters work, compilers etc. You're probably past this point.

2.Low level programming Basically C, but pay attention to the OS APIs (posix, win32). Make sure you understand the fundamentals of memory management, procedures, threading, etc. You need a lot of C knowledge.

3. Networking [0] You basically need to know by heart all the TCP protocol. I have a friend who's incredibly successful working in security and he knows each bit in each packet in a TCP connection. He can just recite it. Once you know about networks, start throwing code at them. See if you can push the wrong bits to a switch, or if you can access some other processes network stack, etc.

4. Web standards Basically, how the web works. Once you're past that: Apache and Nginx. You have to know them in depth.

5. Known threats and vunerabilities In this process you'll know that there are many exploited issues that have been resolved. But you should study from them. For example, Heartbleed. Would you have the knowledge to find Heartbleed? You should also practice with every other security threat known like XSS, SQL Injection, etc.

[0] depending the security field, you might not need so advanced networking knowledge, this is just a general recommendation.

This is just my recommendation, I'm more of a purist, and I have a lot of respect for cybersecurity people.

Source: +10 years programming, I have a good friend making A LOT of money as a private security contractor and we speak about this all the time.

Is the OSCP certification worth it?

I’m a mid level security architect (governance, risk, compliance) and I’m a below average developer, coming from DevOps/infrastructure before. In my security roles, no development or software engineering skills are required.

I might work on improving eventually, it's just not a priority. Any upward trajectory now is going to be from experience and soft skills.