Security Engineering
by Ross J. Anderson · first published 2001
78% recommend22% neutral
Why HN recommends it
Readable survey of security as a whole system, not just encryption, tying design principles to real examples like chip-and-PIN and physical tamper protection. Suits beginners and engineers.
Summarised by Claude from recommending comments
A guide to building dependable distributed systems. The book is written by Ross John Anderson, Professor of Computer Security at University of Cambridge. It covers a wide range of distributed systems from a security professional's perspective. Very thorough and highly recommed for all security enthusiasts.
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2016–2024Practical Reverse Engineering
Bruce Dang, Alexandre Gazet, Elias Bachaalany
Recommended by 6 · mentioned by 86 recommend · 8 mention6 recommend · 86 recommend
2013–2017A tangled web
Lucy Maud Montgomery
Recommended by 2 · mentioned by 22 recommend · 2 mention2 recommend · 22 recommend
2013–2017The IDA Pro book
Chris Eagle
Recommended by 5 · mentioned by 75 recommend · 7 mention5 recommend · 75 recommend
2009–2023The web application hacker's handbook
Dafydd Stuttard, Marcus Pinto
Recommended by 31 · mentioned by 4831 recommend · 48 mention31 recommend · 4831 recommend
2009–2017Gray hat Python
Justin Seitz
Recommended by 5 · mentioned by 85 recommend · 8 mention5 recommend · 85 recommend
2009–2020The shellcoder's handbook
Chris Anley, John Heasman, Felix Linder, Gerardo Richarte
Recommended by 8 · mentioned by 98 recommend · 9 mention8 recommend · 98 recommend
2013–2024Practical Malware Analysis
Michael Sikorski, Andrew Honig
Recommended by 13 · mentioned by 1613 recommend · 16 mention13 recommend · 1613 recommend
…practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book. 3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they…
on “Cybersecurity Humble Book Bundle” ↗…with RSA 1024 were returned as fails" are totally meaningless. I wish people had more confidence in good old science (like Anderson's works) than glamorous events like this. You should all check out Security Engineering by the same author, it's free! www.cl.cam.ac.uk/~rja14/book.html
on “Meeting Snowden in Princeton” ↗…supplement to #1 for application security, obviously focused on mobile apps. 3. The Art of Software Security Assessment The bible of the security industry. Especially instructive for source code review. 4. Security Engineering (Ron Anderson) Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software. 5. The Tangled Web Excellent historical background and good high level overview…
on “Ask HN: What are the best books for learning information security?” ↗…with Hacking: The Art of Exploitation and then proceed to Reversing: Secrets of Reverse Engineering or Practical Reverse Engineering. You'll also want to read The Art of Software Security Assessment and Security Engineering alongside those, to develop excellent source code auditing and binary penetration testing skills. Frankly you should read those no matter what you do in security. 5. It's very possible to earn a competitive…
on “High frequency security bug hunting: 120 days, 120 bugs” ↗Ross Anderson's Security Engineering is an excellent introductory book. Highly readable, and broad but not very deep. The first edition is free online (and is still a perfectly resource; the second edition has a few added chapters): http://www.cl.cam.ac.uk/~rja14/book.html
on “Ask HN: Where did you learn about security/attacks?” ↗…at the defense measures, see "Physical Security Devices for Computer Subsystems: A Survey of Attacks and Defences" http://www.atsec.com/downloads/pdf/phy_sec_dev.pdf IIRC there's a chapter on it in "Security Engineering" by Ross Anderson, too: https://www.cl.cam.ac.uk/~rja14/book.html (whole 1st edition is at the bottom of the page) Edit: The story of Chris Tarnovsky and his work in satellite TV smartcards is also a…
on “Pentium-III autopsy” ↗There's an interesting chapter on Nuclear Command and Control in Ross Anderson's Security Engineering: http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c13.pdf
on “Almost Everything in "Dr. Strangelove" Was True” ↗Security Engineering: A Guide to Building Dependable Distributed Systems by Ross Anderson is available online for reading -- http://www.cl.cam.ac.uk/~rja14/book.html A couple of other resources: - 7 Security Measures to…
on “A practical security guide for web developers” ↗Around 2003 I was a chief technical architect at a startup. We had to secure access to the products and I realised I had no clue. I read Security Engineering by Ross Anderson and was hooked. Went on to do a Masters in Information Security while still coding, and gradually moved into the security field. I still spend a lot of time with developers, currently…
on “Ask HN: If you were a coder who successfully changed careers, what do you do now?” ↗There are many good books on security architecture. The technical details change every week, but the fundamental approach does not change. "Security Engineering" by Ross Anderson is a must-read: https://www.cl.cam.ac.uk/~rja14/book.html (it's freely available, too)
on “Linus Torvalds: “Do No Harm”” ↗…new documents available now, but the story as such seems to have been known for a while. I first learned of it last summer while reading some of the drafts for Ross Anderson's update of his excellent Security Engineering. See chapter 26, https://www.cl.cam.ac.uk/~rja14/book.html
on “How the CIA used Crypto AG encryption devices to spy on countries for decades” ↗…on HN[1]) After coming across another guide PA had composed for management-level decisionmakers[2] I found this site through a series of links. One of the books from this list that I really like is Security Engineering. I found it odd that they don't have it categorized under any of their technical filters. They do give a brief overview of their reasoning for listing it here[3]. [0]: https://www.paloaltonetworks.com/content/dam/pan/en_US/asset...…
on “Cybersecurity Canon” ↗If you've not seen it already, Ross Anderson's book is both excellent and free (second edition at least, third edition has free chapters and doesn't cost much) Security Engineering: https://www.cl.cam.ac.uk/~rja14/book.html His student network social's are filled with examples of defeating various commercial security systems.
on “FortiLock: The Future of Unhackable Authentication” ↗…detection, mechanisms to detect decapping/stripping, wire mesh shielding, protection against ultra-violet laser stimulation of transistors, ... are all important. For those interested in further reading, Security Engineering[1] by Ross Anderson contains a section on chip security. Another paper[2] by Ross Anderson and Markus Kuhn (1996) provides additional background. [1] https://www.cl.cam.ac.uk/~rja14/book.html [2] https://www.cl.cam.ac.uk/~rja14/tamper.html
on “Backdoor found in a China-made US military chip ” ↗Reading Ross Anderson's "Security Engineering" is probably a good idea. It covers security as a system, instead of concentrating just on encryption. PDF of the first and second editions available at [ https://www.cl.cam.ac.uk/~rja14/book.html ]
on “Basic Cryptography Concepts for Developers” ↗