Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can I learn computer security?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Ask HN: How can I learn computer security?

#41

Post by ajr0 »

yes.

Data Science can be applied in many different ways, (somewhat) Recently LightCyber was acquired by PANW [0] and I believe that if you are in data science that may be something that tickles your itch.

if I may give advice, asking a more specific question to a search engine may also get you ona path with additional information. 'cyber security' is a pretty large umbrella and much of it may bore you while only a small handful is interesting... so try to be more specific rather than say 'stuff'

[0] https://www.paloaltonetworks.com/products/secure-the-network...

Re: Ask HN: How can I learn computer security?

#43

Post by cschmidt »

Since no one has mentioned it yet, Capture the Flag contests (CTF's) can be a good way to get into security. They are online contests featuring a series of security related puzzles.

They are hosted by lots of different groups at different levels. There are CTF's aimed from high school through the DEFCON CTF. This is a directory: https://ctftime.org/

Re: Ask HN: How can I learn computer security?

#44

Post by vog »

justaman wrote: post #29
vog wrote: post #24

If you want to get a really deep understanding, study computer science (e.g. bachelor/master) [1], then specialize by taking all security courses that are offered. Not only will you get a deep understanding of the topic, you will build on solid fundamentals, as well as have people (professors, assistants, trainers) who you can ask anything. [1] Of course, you can this only freely in a country that remotely cares abou…

I went to a mid level business school in the Midwest. Their IT program had a few segments. One was security. The difference was basically just one course on pen testing. I learned more about security in the CS courses they didnt recommend I take. You don't need college, what you need is a desire to learn everyday.

> what you need is a desire to learn everyday

This is true, but in my opinion this advice misses the point.

Of course, if you are older and finally developed this skill, you don't need anything more. However, the questioner seems to be on the beginning of this journey.

Recommending "just learn everyday" is like telling fat people to exercise and not to eat too much. Of course that's true, but misses the point: How to get there?

Having people around you who motivate you to learn, who know and acknowledge what you are doing, and who are willing (and paid for) to help you if you get stuck - this is exactly what young and/or inexperienced people need, and a very good starting point until they are finally able to get along with the internet and nobody's assistance anymore.

Re: Ask HN: How can I learn computer security?

#46

Post by _spoonman »

wepple wrote: post #38
_spoonman wrote: post #28

Is the OSCP certification worth it?

It depends. If you’re expecting it to land you a job, no. If you’re trying to add to your arsenal of skills, maybe (arguably you could self teach a lot of it and save your money). If you’re trying to get past HR in some big company who use it’s metric, yeah sure. It also depends on what you want to do - I gather it’s useful for netpens but useless if you want to do appsec, which is a huge chunk of pentest work. What…

No goals per se...just kind of interested in the field and would be doing it for personal interest. I've found tons of sites that offer lab environments and downloadable VM's that allow you to practice exploits so maybe that would be a cheaper way to go in the beginning.

Re: Ask HN: How can I learn computer security?

#47

Post by gt_grc »

amorphous wrote: post #35
artie_effim wrote: post #11

Cyber pro here - 5 years doing IV&V testing, 15 years as Fed, State and Local contractor, now a firewall admin at a major U.S. uni. I got an NSA accredited ( https://www.nsa.gov/resources/educators/centers-academic-exc... ) Master's in IT with a specialization in security. While the degree got my foot in the door (I have a BA in Arts - but have been messing around with computers since the early 80's - plus a lot of s…

I'm interested in GRC - could you explain what else to study or what certs to get to go that route? Thanks

I don't have any other recommendations for studying, but as someone who made the transition from IT to GRC, I can offer some advice about getting practical experience.

A Big Four firm is a good place to get started in a GRC career. You'll get pretty broad exposure to the field, and you'll have the opportunity to develop expertise in specific GRC domains.

If you're already working in a regulated industry (especially for a publicly traded company), you may be able to move into a GRC position at your present company. Compliance, internal audit, third party risk management, business continuity/resiliency and disaster recovery are common areas that fall under the broad GRC umbrella.

I worked in various IT roles at a financial services company, and I was able to move into a risk analyst role, then I went to a Big Four firm, and I'm now back in industry.

As far as certs go, CRISC, CISA and CISSP are the most common I've seen among GRC folks, although most of the people I've worked with didn't have any of them.

Re: Ask HN: How can I learn computer security?

#48

Post by hackermailman »

This is a good course

https://www.cs.cmu.edu/~213/schedule.html

Buy the 3rd version book (used) and then try the labs as you go through the lecture vids/chapters http://csapp.cs.cmu.edu/3e/labs.html but avoid the 'global edition' as it's filled with errata, or just know there is mistakes.

You will learn assembly/C and also Return Oriented Programming, stack protections and how they work, buffer overflow attacks, implicit casting grenades, cache optimization, how the linker works, ect. Then you sign up for that old Matasano CTF https://microcorruption.com/login

When you complete it apply to NCC Group who I believe now owns microcorruption. Start at the bottom, work your way into a policy/advisory role somewhere else after gaining experience and applying for certs https://ciso.eccouncil.org/ Having data science experience is likely helpful since you can produce shiny presentations that board rooms like to see when you become their CISO

Re: Ask HN: How can I learn computer security?

#49

Post by artie_effim »

elorant wrote: post #12
artie_effim wrote: post #11

Cyber pro here - 5 years doing IV&V testing, 15 years as Fed, State and Local contractor, now a firewall admin at a major U.S. uni. I got an NSA accredited ( https://www.nsa.gov/resources/educators/centers-academic-exc... ) Master's in IT with a specialization in security. While the degree got my foot in the door (I have a BA in Arts - but have been messing around with computers since the early 80's - plus a lot of s…

While on the subject and since you're an expert in the field, there's something that's nagging me. How good are you guys at programming? My feeling is that most people in the infosec are average at best and only the elites are good at it.

pretty bad - hack it together with docs and stack exchange really. I did manage to deploy an app with a django, nginx, gunicorn stack which doesn't crash, so there's that. But as far as good coding skills, I don't really have any - but I'm learning as I go. I also have full management support for this, which is nice, but very rare. I more so play around with pandas and matplotlib to get what I need - pretty much just a step above shell scripting.

Re: Ask HN: How can I learn computer security?

#50

Post by Hextinium »

godelmachine wrote: post #34
santiagobasulto wrote: post #26

Let me tell you one thing, it's going to be tough. Cyber security is one of the fields of IT that requires the most deep knowledge of how computers and networks work. So, be aware of that. It's like, when someone is asking how to build a game, and the first answer is: learn a lot about Math and Physics. This is the same thing. Recommended path: 1. CS Basics (concepts) Conceptually understand how computers work, how i…

May I ask how much you friend makes, on an average?

I had a teacher who's brother worked in security, his bonus for the year was 6 figures IIRC. His salary was 300k but this was a while ago (5+ years).
Post reply on HN