There are many areas of competence in the field of security, so it depends a lot on what you want your career path to look like. At the end, bit bytes have penetration testing and a “security study” (which is often “cataloging programming errors” as an actual study). More strategically, there is “risk management” that often spends most of the time for non-technical reasons, such as appropriate budgets, education and response.
Blah, blah, blah, but how do you get started, right? Perhaps the best author on the "big picture" is Bruce Schneier . He is a cryptographer, but he focuses on things like security psychology, social attacks and how to really think about security. Crypto-Gram is required to read how to think in this space.
In areas with bits and bytes, you probably want to find out in which area you are most interested in digging (Windows, wireless, Internet, physical, iPhone, the list goes on and on). If I had to choose one paper, I would start with Smashing The Stack For Fun and Profit . Still, all these years later, the best introduction to the key attack class and how technical attacks work as a whole. If these types of attacks really interest you, my favorite book on this subject is the Handcoder Handbook . His attacks are old; many of them will no longer work as they are. But they form the basis of how many attacks are still made today.
If you want to move the “value chain” to “business-oriented security” (and learn how to use such phrases without quotes), you should start work on CISSP . People can discuss as long as their blue color does not become CISSP really something. Answer: this means getting a job when CISSP is a requirement. My feelings on CISSP? Any true security professional should be able to pass it on. Thus, this is a good basic certificate for whether you are a true security professional, what it should be). He teaches the general terminology that has grown in the security world, and the study of terminology is part of the professional (as in any other profession from law to engineering). CISSP is very wide, and studying this will give you a much better idea of ​​which areas you are interested in, even if you never sit at the test. There are tons of books in the CISSP; All in one is good. Reading this volume will not make you a security expert, but it will introduce you to what security experts know.
My experience in risk assessment. For many years I traveled around companies, evaluated their environment and told them what to fix in order to protect their most confidential information. Probably the most useful training for me was IAM (NSA Infosec Assessment Methodology). Now it is updated in the new ISAM. He focuses on figuring out which parts of the infrastructure really matter, and then protecting them. The most important security tool I used: Powerpoint to make slides that let the client understand what they need to understand and implement. And a decent suit. Understanding this material is one thing. You need very strong technical skills; what is given. But in reality, the difference requires a lot of people’s skills, presentation skills, project management and follow-up. This is what separates "from professionals."