Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How can I learn computer security?

news.ycombinator.com

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Ask HN: How can I learn computer security?

#51

Post by M8thril »

santiagobasulto wrote: post #26

Let me tell you one thing, it's going to be tough. Cyber security is one of the fields of IT that requires the most deep knowledge of how computers and networks work. So, be aware of that. It's like, when someone is asking how to build a game, and the first answer is: learn a lot about Math and Physics. This is the same thing. Recommended path: 1. CS Basics (concepts) Conceptually understand how computers work, how i…

> Let me tell you one thing, it's going to be tough. Cyber security is one of the fields of IT that requires the most deep knowledge of how computers and networks work. So, be aware of that. It's like, when someone is asking how to build a game, and the first answer is: learn a lot about Math and Physics. This is the same thing.

> Recommended path:

> 1. CS Basics (concepts) Conceptually understand how computers work, how interpreters work, compilers etc. You're probably past this point.

> 2.Low level programming Basically C, but pay attention to the OS APIs (posix, win32). Make sure you understand the fundamentals of memory management, procedures, threading, etc. You need a lot of C knowledge.

> 3. Networking [0] You basically need to know by heart all the TCP protocol. I have a friend who's incredibly successful working in security and he knows each bit in each packet in a TCP connection. He can just recite it. Once you know about networks, start throwing code at them. See if you can push the wrong bits to a switch, or if you can access some other processes network stack, etc.

> 4. Web standards Basically, how the web works. Once you're past that: Apache and Nginx. You have to know them in depth.

> 5. Known threats and vunerabilities In this process you'll know that there are many exploited issues that have been resolved. But you should study from them. For example, Heartbleed. Would you have the knowledge to find Heartbleed? You should also practice with every other security threat known like XSS, SQL Injection, etc.

> [0] depending the security field, you might not need so advanced networking knowledge, this is just a general recommendation.

> This is just my recommendation, I'm more of a purist, and I have a lot of respect for cybersecurity people.

> Source: +10 years programming, I have a good friend making A LOT of money as a private security contractor and we speak about this all the time.

Great answer. Look at an offensive security certified professional course for a basic affordable course that covers all of the above.

Re: Ask HN: How can I learn computer security?

#53

Post by wepple »

_spoonman wrote: post #46
wepple wrote: post #38

Earlier quoted context omitted.

It depends. If you’re expecting it to land you a job, no. If you’re trying to add to your arsenal of skills, maybe (arguably you could self teach a lot of it and save your money). If you’re trying to get past HR in some big company who use it’s metric, yeah sure. It also depends on what you want to do - I gather it’s useful for netpens but useless if you want to do appsec, which is a huge chunk of pentest work. What…

No goals per se...just kind of interested in the field and would be doing it for personal interest. I've found tons of sites that offer lab environments and downloadable VM's that allow you to practice exploits so maybe that would be a cheaper way to go in the beginning.

Yeah totally do that then. And get a copy of burp and hack some web stuff. Have a crack at bug bounties to test your chops.

Re: Ask HN: How can I learn computer security?

#54

Post by torihuud »

I know and can recommend a very efficient and trustworthy hacker. I got his email address on DISQUS. He is very nice and he has helped me a couple of times even helped clear some discrepancies in my account at a very affordable price. he offers a top notch service and I am really glad I contacted him. He's the right person you need to talk to if you want to hack any of your spouse’s social network account or whatsapp, He offers a legit and wide range of hacking services. His charges are affordable and reliable, contact him via address below... Email: brianhackwizard@gmail.com Text no: +1(571)-286-5929. Whatsapp no:+1(628)-203-5734

Re: Ask HN: How can I learn computer security?

#56

Post by thephyber »

indigochill wrote: post #13

Security fundamentally is just "the art and science of how things work". Breaches in security are caused by malicious actors finding vulnerabilities in trusted systems, such as when Chinese webcams shipped with default credentials which made it trivial for the Mirai botnet to take them over and acquire so many devices that it could DDoS Dyn. Towards that end, just about anything you learn can be applied in some way t…

> Breaches in security are caused by malicious actors finding vulnerabilities in trusted systems

Alex Stamos, the CISO of Facebook, likened the causes of security breaches to a pyramid. The bottom of the pyramid, where the vast majority of security breaches happen (perhaps 80%), are caused by basic fraud: shared passwords, phishing, asking the user to do something like self-XSS. Of the remainder, perhaps 80% of security breaches are done through the more common, more mundane attacks like unpatched vulnerabilities or misconfigurations. It's only a fraction of a fraction of a percent of attacks that are done using zero-day vulns.

As much as what you said is relevant for security, I would argue that engineers think that security is more of an engineering problem set than it is.

Re: Ask HN: How can I learn computer security?

#57

Post by thephyber »

amorphous wrote: post #36
sectossaccount wrote: post #31

Just created this account so that I could comment, and stay (reasonably) anonymous. I'm the CTO of a reasonably well known security company, for what it's worth - and I've been doing this for a little over two decades in a few countries. This first misnomer, is that there's one security thing. There are several. The offensive security folks (penetration testers) are far different than the advisory folks (think PCI, H…

Thanks for your reply. I asked above already, could you explain what to study or what certs to get to follow the path of "advisory folks (think PCI, HIPAA)"

Not the gp, but I also work in security (not in management).

"What are the best information security certifications?" @ Quora[1]. The problem is that it's a massive list. Even if you pick a short list / subset of this list, it's far too much work to get started.

Honestly, I would join/start a club at your school or in your neighborhood. Find people with similar interests. Work together on a single certification. Start small and target a single subset of "cybersecurity".

Honestly, I would start by trimming down the list by filtering out what you aren't close to achieving yet. If a cert requires access to Cisco hardware or assembly language programming skills, there is no point in working on one of those certs first.

[1] https://www.quora.com/What-are-the-best-information-security...

Post reply on HN