Sometimes I get lucky and get access to certain people that I consider exceptional masters of their craft. If you have one question and you need to make it count, what would this question be? The one I am using is the following:
“Share the top three resources for your domain of expertise. It can be a book, a video, a research paper, an article, a website, whatever you want”” (or a variation thereof, depending on the receiving party. If possible I follow up “Why these three?” (although quite often when folks share these three resources with me, state the reason for doing so). This got me thinking, if someone was to ask me “What are the top three resources in the field of information security?”, what would my answer be? Information security is a broad field after all and one can deduce from the question above that this might be a question from someone who is about to start (or has only recently started) their way towards the proverbial Light. So that would be my answer:
“Security Engineering, Third Edition” (978-1119642787) by the late Ross Anderson. This particular gem of a book not only is an excellent introduction to the domain but serves as a way to enter the security engineer’s state of mind, as it contains a multitude of where and how security makes and does not make sense. Runner Up: “Secrets and Lies: Digital Security in a Networked World” (978-1-119-09243-8) by Bruce Schneier. While quite old by now, it is amazing how Bruce Schneier was discussing points that were unheard of in 2000 (year of original publication) and are commonplace now (including security measures). Any of these volumes will get you to start thinking as a security engineer.
Now that we have the mentality, you need to check how it is applied. Look no further than Phrack – a “old skool”-ish zine, written by the community for the community. In addition to discussing real world attacks and defences, it also serves as a living testament to the community culture and overall transformation (from a geeky hobby to something that affects geopolitics, including a hiatus when all the “cool kids” were too busy presenting to security conferences. It goes well into the 80s so it serves as a cultural artifact. Runner Up: PoC||GTFO almost made the cut and by all means check it out (the focus is on extreme tech artifacts) but I decided to go for Paged Out – still evolving but it is a live one and by supporting, we can get the next great zine.
Last but not least, the last resource is the most difficult one to find. I strongly believe that no person is an island so your best bet is to find an online community that suits YOU. This assumes you have done your introspection and know what to look for both from a skills perspective, as well as a cultural one. I have been involved in many communities, some awful, some great, a lot of ok-ish and overall learned (and keep learning) stuff that is hard to find elsewhere.
(As for the obligatory music reference: I used this question, almost verbatim to a music producer I met by chance – a music producer that has worked on songs and artists that you probably have heard. The results, positively surprised me).
Athanasios Kostopoulos 