So You Want to Be a Security Expert
I have no idea what his list would actually make you, but it wouldn't be anything I'd consider to be approaching "security expert".  So, here's my list, So You Want To Break Shit:<p>- Learn C.  Learn it well.  That will give you the level of understanding you need of the way the computer works.<p>- Learn Python or Ruby.  If you can automate something, do it.  Computers are better than you at repeatable tasks.<p>- Learn x86 assembly (to start).  Write some C code, compile it down to assembly, and read it; understand how the two map to each other.  Get your friends to write stuff for you and decompile it back to C, and have them check your work.<p>- Learn the basics (at least) of web development.  Understand how web applications work, understand the constraints it puts in place, understand the interactions between the client and server.<p>- Internalize the OWASP Top 10.  Understand and be able to recognize and mitigate XSS, SQL injection, command injection, arbitrary file reads/writes, etc.<p>- Grab old versions of open source software and rediscover known vulnerabilities.  Grab the latest versions of open source software and discover new ones.  Start off looking for simple things, and know it well.<p>- Reverse-engineer network protocols.  Pick a game, write a server emulator for it.  This is a great way to use all your skills up to this point.  It's also a lot of fun (it's how I cut my teeth).<p>- Write a debugger.  Understand the interaction between hardware, the kernel, and userland.<p>- Understand, understand, understand.  Ask questions.  Ask a <i>lot</i> of questions.  In my opinion, the key to security is always asking "Why?"<p>These are in no particular order, and none of these is more important than the other.  It also jumps all over the place, perhaps because that's what I do myself; I may be breaking a web app one day and reversing some hardware the next.  But these are things I feel are important, and will give you some direction.<p>If anyone has any questions, wants direction, or anything else, my contact info is in my profile.  The world needs more breakers.