Beginning Web Security? [closed]

Question

I just came back from a hackers conference about internet security and I'm interested in learning web security and protecting companies from hackers. But I don't know where to start and what languages to learn..

Could anybody point me in the right direction for this?

Answer 1

Everyone has their own philosophy of security. Developing your own philosophy is vital. This is the reason why Bruce Schneier is so popular, and I read every blog post.

In the current state of security the landscape is littered with security systems that fail. I believe this is because of the following quote.

"What I cannot create, I do not understand."

--Richard Feynman

Learning how to break software is the most important step in learning in how to protect it from attack. You must find vulnerabilities in software and write exploit code.

Answer 2

This is kind of an enormous field. People make lifetime careers from it. As a beginner, you'll want to learn:

• HTML, XML and XHTML
• Javascript, and once you know it, read about cross-site scripting attacks
• SQL, and once you know the basics, injection attacks
• Basics about hashes, salts, public key encryption, and how HTTPS works
• How certificates work

That should be a good start.