Resources
A curated set of places to go deeper. Books, university courses, standards, tools, practice platforms, and a few people worth following.
Books
Cryptography Engineering
Ferguson, Schneier, Kohno. The most readable practical introduction to modern crypto.
Security Engineering (3rd ed.)
Ross Anderson. Sweeping, opinionated, free online. The closest thing the field has to a canonical text.
The Web Application Hacker's Handbook
Stuttard & Pinto. Dated in places but still the deepest reference for web attack technique.
Hacking: The Art of Exploitation
Jon Erickson. Memory corruption from first principles, with a Linux live CD.
Practical Cryptography for Developers
Svetlin Nakov. Free, code-first. Good if you learn by running things.
Computer Networking: A Top-Down Approach
Kurose & Ross. The default undergraduate networking textbook for a reason.
University courses (free online)
Stanford CS155, Computer and Network Security
Dan Boneh and John Mitchell's undergraduate course. Slides and notes posted openly.
Cryptography I (Coursera)
Dan Boneh. Still the best free crypto course on the internet.
MIT 6.5660, Computer Systems Security
Open lecture notes and assignments covering systems-level security.
CMU 18-487 / 14-741, Intro to Information Security
Classic CMU security curriculum, lecture material online.
Standards & reference docs
RFC 8446, TLS 1.3
The current TLS specification. Dense, but readable in chunks.
RFC 5280, X.509 PKI
Certificate and revocation profile used by the web's PKI.
NIST Cybersecurity Framework
A vocabulary for talking about controls and posture with non-engineers.
MITRE ATT&CK
A taxonomy of how real adversaries behave, mapped to detection and mitigation.
Mozilla Web Security Cheat Sheet
Short, opinionated guidance on TLS, headers, CSP, cookies.
Tools (legal use only)
Hands-on practice
OverTheWire
Linux and crypto puzzles via SSH. The Bandit wargame is a classic starting point.
Worth reading regularly
Krebs on Security
Brian Krebs' investigative reporting on real incidents and the criminal economy.
Schneier on Security
Bruce Schneier's essays. Heavier on policy and trust than vulnerabilities.
Project Zero
Google's offensive research team. Long, technical writeups.