What To Study?

[bobbyb1980]

Greetings fellow hackers. Currently I work as an info security consultant and have been so for about 4 months. Things are good. My responsibility is more focused on preventing internal theft and development of methods to minimize fraud in the payment processor industry. We thwart A LOT of social engineering attacks and try to develop ways for people to transfer money in a practical yet highly secure fashion between different countries. I have a SQL guru who works with me and he makes sure things are covered on that end. Usually the networks we work with are already hardened so no need to go there either.

Right now my job doesn't require a lot of technical knowledge. I can do basic pen tests and the bare bones stuff we learn on the show but I am still a long ways from developing my own exploits and scripting my way trough a pentest. Years ago I got A+, Net+, and Security+ certified, but this was about 2005 or so and much has changed since then. However, I do know that in another 5 years my job is going to require me to have a very high degree of technical knowledge as many of the other people who work my position for other groups have masters degrees and write books and whatnot.

This is my question. I'm not a classroom person, I prefer to learn on my own. But what should I study? Currently I am studying Python for 1 hour to 90 minutes per day, then I'll study metasploit for the same time (I bought the book). Does anyone have any recommendations of programming languages to learn or things to read that would directly benefit someone in the security field? Any advice from the gurus out there?

Long live hak5.

[int0x80]

I'm not a guru; but really it comes down to figuring out what you want to do. I wanted to do RE, so I started spending more of my free time doing crackmes, analyzing malware, and cracking software. Figure out what you want to do, learn what that entails, set goals, and then do it. Get stuck/frustrated? Try harder, no excuses, etc.

[badbass]

I want to learn anything I can about computers networking linux routers other os's Smart cards rfid electronics hell even parking meters(siemens). Most importantly how people think. When I was 16 I looked over 25 had some grey hair and a beard. I would go to the store grab a six pack and go to the counter and check out UN-questioned. This could be called hacking.

[Infiltrator]

I have to agree with int0x80, it really comes down to what you want to do. I could tell you what to study today, but tomorrow you might change your mind and want to study something else.

You said yourself that you are far from developing your own exploits and scripts, you could use your spare time to learn how exploits/scripts work and then learn how to write your own.

Metasploit framework may seem an easy tool to use, but it can get quite complex at times, here's another opportunity you have to develop your skills.

Again keep reading, researching and practicing while you can, that's the only way you will get to the top.

These are good InfoSec resources you could utilize to learn more

www.pauldotcom.com

www.irongeek.com

www.securitytube.net

www.hak5.org (of course)

Edited February 3, 2012 by Infiltrator

[Doctor]

Rreally all I can do is agree with Infiltrator and int0x80. Set up a couple virtual machines on you computer and just play around. Figure what you like, what you don't like and go from there. I'm not gonna lie because as you no doubt know, this is gonna take months if not years of practice and your always gonna be learning. So buy some books, search some forums and figure what it is you want to learn and become good at.