Cybersecurity Humble Book Bundle
So, I&#x27;ve read most of these. Here&#x27;s a tour of what is definitely useful and what you should probably avoid.<p>_________________<p>Do Read:<p>1. <i>The Web Application Hacker&#x27;s Handbook</i> - It&#x27;s beginning to show its age, but this is still absolutely the first book I&#x27;d point anyone to for learning practical application security.<p>2. <i>Practical Reverse Engineering</i> - Yep, this is great. As the title implies, it&#x27;s a good practical guide and will teach many of the &quot;heavy&quot; skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like <i>The IDA Pro Book.</i><p>3. <i>Security Engineering</i> - You can probably read either this <i>or</i> <i>The Art of Software Security Assessment.</i> Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like <i>The Art of Computer Programming</i> for security. Everyone says they have read them, they definitely should read them, and it&#x27;s evident that almost no one has actually read them.<p>4. <i>Shellcoder&#x27;s Handbook</i> - If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book.<p>5. <i>Cryptography Engineering</i> - The first and only book you&#x27;ll really need to understand how cryptography works if you&#x27;re a developer. If you want to make cryptography a career, you&#x27;ll need more; this is still the first book basically anyone should pick up to understand a wide breadth of modern crypto.<p>_________________<p>You Can Skip:<p>1. <i>Social Engineering: The Art of Human Hacking</i> - It was okay. I am biased against books that don&#x27;t have a great deal of technical depth. You can learn a lot of this book by reading online resources and by honestly having common sense. A lot of this book is infosec porn, i.e. &quot;Wow I can&#x27;t believe that happened.&quot; It&#x27;s not a <i>bad</i> book, per se, it&#x27;s just not particularly helpful for a lot of technical security. If it interests you, read it; if it doesn&#x27;t, skip it.<p>2. <i>The Art of Memory Forensics</i> - Instead of reading this, consider reading <i>The Art of Software Security Assessment</i> (a more rigorous coverage) or <i>Practical Malware Analysis.</i><p>3. <i>The Art of Deception</i> - See above for <i>Social Engineering.</i><p>4. <i>Applied Cryptography</i> - <i>Cryptography Engineering</i> supersedes this and makes it obsolete, full stop.<p>_________________<p>What&#x27;s Not Listed That You Should Consider:<p>1. <i>Gray Hat Python</i> - In which you are taught to write debuggers, a skill which is a rite of passage for reverse engineering and much of blackbox security analysis.<p>2. <i>The Art of Software Security Assessment</i> - In which you are taught to find CVEs in rigorous depth. Supplement with resources from the 2010s era.<p>3. <i>The IDA Pro Book</i> - If you do any significant amount of reverse engineering, you will most likely use IDA Pro (although tools like Hopper are maturing fast). This is the book you&#x27;ll want to pick up after getting your IDA Pro license.<p>4. <i>Practical Malware Analysis</i> - Probably the best single book on malware analysis outside of dedicated reverse engineering manuals. This one will take you about as far as any book reasonably can; beyond that you&#x27;ll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports.<p>5. <i>The Tangled Web</i> - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside <i>The Web Application Hacker&#x27;s Handbook.</i> Unlike many of the other books listed here it is a practical <i>defensive</i> book, and it&#x27;s very actionable. Web developers who want to protect their applications without learning enough to become security consultants should start here.<p>6. <i>The Mobile Application Hacker&#x27;s Handbook</i> - The book you&#x27;ll read after <i>The Web Application Hacker&#x27;s Handbook</i> to learn about the application security nuances of iOS and Android as opposed to web applications.