The art of software security assessment

What Hacker News says

1. rramadassApr 2025
   It depends on what exactly your program does and equally important, where it is deployed and used. Security is a matter of degree based on context i.e. there are levels of Security. It is not a all or nothing proposition.

   If your program is going to be used for some non-critical work internally you don't have to bother much about attack surface/vectors etc. Just use some standard "healthy" compiler options and you are good.

   If you would like to know more on this subject, i recommend reading the classic The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities by Mark Dowd et al.

   Show morethread
2. RecipeForStuffDec 2022
   * Learn to code. If you can read and write code, it will boost your effectiveness in your role. * Read "The Art of software security assessment", "Network Security Assessment" and "Web Application Hackers handbook". They're quite old now but good content. * Participate in CTFs. * Play on practice platforms like HTB. * Work through Portswigger labs, its free and top quality content. * Attend local security meetups and conferences, network.
   Show morethread
3. xyzzy123Jul 2022
   Some ideas for improving, uh, "cyber skills" (mainly offsec):

   Find vulnerabilities in software, the more widely used the better. Try both closed & open source software. Publish some CVEs. Different approaches can work depending on your preferred "style" but following a methodology (e.g. OWASP web security assessment guide, OWASP code review guide, or the approach from "The Art of Software Security Assessment") will reliably net bugs if you are persistent.

   Team up - find groups adjacent to your interests and get involved. CTF teams are good for this, ideally you want somethings where you work together with others towards a common purpose.

   Try some bug bounty programs. You will find you need some "unique" angle to be able to get anywhere. Even if you don't make any money (you might, you might not) it's a good excuse and the money is decent motivation to spend time looking for bugs on "real" websites. Find discords & slacks relevant to BB hunting and join them. Talk with people about it.

   Get a certification. Yes, they suck. Optional. But if you have an industry cert and a detectable pulse you can probably get a job in computer security (whether it's one you want is another question, but it's an option to jam a foot in the door).

   I dunno if this is on target for you, I made a lot of assumptions here about the size and shape of the dent you might want to make in the world.

   Whatever you do, it helps to prioritise "visible" activities that produce concrete achievements that help you build a rep and a network. "Network" is kind of a sterile word but I couldn't think of a better one. The computer security industry is very "cliquey", it helps a lot to get involved in activities that help you get to know people, and make you "known" to others.

   I don't have much advice for business lol.

   Show morethread
4. appsecengthrowFeb 2021
   Application Security Engineer here. For a developer I would recommend the OSWE certification which takes a more code-centric approach and resources such as https://portswigger.net/web-security and The Art of Software Security Assessment book. You can also leverage your DevOps experience for learning about server, app and cloud misconfigurations and their impact on security.

   The demand for network security is not as high as for appsec people and I personally don't see network security as very rewarding (intellectually and financially).

   For the Pentesting route I recommend trying some HackTheBox and watching Ippsec's channel (https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA). OSCP is fine, but it is a beginner certification and definitely not enough for getting a Pentest job.

   Show morethread
5. snazzDec 2020
   As for books, The Art of Software Security Assessment is frequently recommended, including by members of Project Zero.
   thread
6. wglbNov 2018
   I was significantly older than 40 when I entered the security field after a career in development and technical management. I would consider this phase of my career successful.

   What has worked for me is a burning curiosity about security, software and things that go crash at night. And a desire to learn.

   Two books are very helpful--The Art of Software Security Assessment, and the Web Application Hackers Handbook. There are many resources available on the web--CTF exercises, post mortems, instructive blog posts, scary news feeds, free tools.

   After getting into security as an application security guy, I ended up with a gig that enabled me to build a team of 15, none who had previous security experience, none of whom had or were expected to get certificates. The team did (and is still doing) some terrific things, and now has expanded responsibilities.

   So look for jobs that give you a work sample product test and don't require certificates. Make your own learning plan.

   Show morethread