Wednesday, November 22, 2006

Three Seven-Book Lists for Novice, Intermediate, Advanced Readers

I continue to receive feedback and questions on my No Shortcuts post. One of you prompted me to write three new Amazon.com Lists, organized thus:

For the civilians out there, that's novice, intermediate, and advanced. :) I listed seven books for each category to keep things manageable. One of the problems I encountered with the advanced list, especially, is that coding becomes a big part of the equation when one starts to consider "advanced" topics. I tried including "placeholder" books to give you the idea that you need coding background to make good use of a book like Unix Network Programming, Volume 1: The Sockets Networking API, 3rd Ed.

Please let me know if you find these lists helpful. Please remember that reading these 21 books in order will not take you from newbie to guru. Rather, these are books I think will help at each stage of your progression. I am also not claiming to be a guru by having selected seven advanced books. For example, I need to get more acquainted with coding in order to branch out into other areas of digital security.

8 comments:

Anonymous said...

i see you chose Farrel over Stevens. I understand your reason - but I'm wondering how it compares to the other classic from the (still living and updating) Comer - search for ISBN:0131876716. If you know it, could you advise whether Farrel is worth tracking down, does he add anything?

Rachael said...

Thanks for the updated lists, Richard. In my opinion, they are very well-organized, and much more useful for those of us searching for the right books to start reading.

Anonymous said...
This comment has been removed by a blog administrator.
Richard Bejtlich said...

I am not familiar with the newest Comer book. I listed books I had read and reviewed, with only one or two exceptions.

Chris said...

Interesting categorization.

You seem to emphasize practice over theory toward the "bootcamp" end of the spectrum, gradually changing the balance toward postgrad. For example, Radia Perlman doesn't show up until stage three.

I can't criticize this approach, but it certainly is different from how I came at the subject (perhaps this is because back in the day much of the "practical" stuff had yet to be written. Perlman's 1st edition preceded Cheswick and Bellovin by two years, eg.).

Personally, I found it extremely useful to read Perlman, and Stallings, and more RFCs than I care to remember, and to get the "practical" side of things through the school of hard knocks and working with people who had been in the game longer. I wonder whether the increasing prominence of "practical" writing reflects a change in how people learn infosec -- less through mentoring, for example?

Anonymous said...

why you don't devide your lists to those catigories:
1.pen testing/hacking
2.forensics
3.security perimeter
4.operating systems/hardening
5.security managament
6.secure coding/developing secure applications
7.security requirement/background

Guillaume said...

I would list Stevens TCP/IP Illustrated Part 1 in the Novice list, then TCP/IP Illustrated Part 2 & 3 in Intermediate or Advanced lists.

Guillaume said...

I also will suggest "Computer Viruses: From Theory to Applications" by Eric Filiol in the Advanced list.