Link to home
Create AccountLog in
Security

Security

--

Questions

--

Followers

Top Experts

Avatar of yn0t1me
yn0t1me🇨🇳

Recommendations for security engineers

I am a college student in China, and I want to contact foreign technical forums and articles in order to improve my professional skills and English ability. Do you have any recommended websites, articles or videos? My area of interest is mainly developing security products in python, security scripts.In the future, I want to become a security R&D engineer, developing waf, vulnerability scanning and other security products. If you have relevant suggestions for me, I would be most grateful!Because my English is not very good, so the appeal content is translated, if there is any ambiguity, please forgive me

Zero AI Policy

We believe in human intelligence. Our moderation policy strictly prohibits the use of LLM content in our Q&A threads.


Avatar of Arnav SharmaArnav Sharma🇦🇺

  • Coursera - Online courses on Python and cybersecurity
  • Cybrary - Cybersecurity training and community resources
  • Infosec Institute - Learning paths in Python and cybersecurity
  • DEV Community - Articles and community for developers
  • Snyk - Security best practices for coding
  • Python.org Forums - Official Python community forums
  • GitHub - Open-source repositories on Python security
  • DeepSource - Code security analysis and best practice articles
  • Aptori.dev - Security cheat sheets and tips for developers

It's great that you're looking to enhance your skills in security development. Here are some recommendations tailored to your goals:

 

Websites & Forums:

  • Stack Overflow: An excellent platform for Python and security programming questions.

  • Security Stack Exchange: Perfect for discussing security concepts and challenges.

  • GitHub: Check out open-source security projects and contribute to improving your skills.

  • BleepingComputer: For security news and technical articles.

 

Videos & Articles:

YouTube Channels:

  • "HackerSploit": For free Python security programming, WAF, and vulnerability scanning tutorials.

  • "John Hammond": An excellent resource for hands-on security scripting and understanding security concepts.

 

Experts-Exchange:

 

 

Technical Certifications:

  • CompTIA Security+: An excellent foundation for security concepts and practical skills.

  • CompTIA Cloud: To understand security in cloud environments.

  • ISC² CC (Certified in Cybersecurity): Great for starting in security with a focus on essential knowledge.

  • CISSP (Certified Information Systems Security Professional): For more advanced Security.

 

Python:

  • Check out Dr. Lerner's Python Courses

           https://store.lerner.co.il/

           https://store.lerner.co.il/advanced-python-bundle

           https://store.lerner.co.il/live-classes.

 

Check the following links to improve your security skills:

https://www.cybrary.it/

https://www.udemy.com/

https://www.schneier.com

http://krebsonsecurity.com

http://www.darkreading.com

https://threatpost.com

https://www.offensive-security.com/blog

https://nakedsecurity.sophos.com

http://www.securityweek.com

http://taosecurity.blogspot.com

http://securityweekly.com

https://www.linkedin.com/learning/

https://www.pluralsight.com/learn

https://www.schneier.com/

 

User generated image
User generated image
User generated image

Stay in touch with your local InfoSec community and to hear the latest in technical wizardry, industry intelligence, and thought leadership that include security. Join their mailing list and events

https://www.sans.org/get-involved/ 

https://www.sans.org/mlp/community-night-events/

 

Learn insights from PyPI infrastructure and operations, including the creation of a new “PyPI Safety & Security Engineer” role.

https://blog.pypi.org/tags/#security

 

Appreciate the Software supply chain security community - shared goals of improving software supply chain security and codifying best practices for development, deployment and governance

https://slsa.dev/community

 

Articles, White Papers, Technical Write-Ups and more authored by members of the GreySec community.

https://github.com/greysec-security-forums

 

Going for associate level skill build up 

https://owasp.org/www-project-application-security-curriculum/ 

https://hackerassociate.com/owas-offensive-web-attack-security/ 

https://learn.snyk.io/learning-paths/security-for-developers/ 

https://www.isc2.org/certifications/associate

 


Reward 1Reward 2Reward 3Reward 4Reward 5Reward 6

EARN REWARDS FOR ASKING, ANSWERING, AND MORE.

Earn free swag for participating on the platform.


There are really great answers above. An additional piece of advice that I would give is to get some schooling inside of the US on an education VISA. This is going open a large number of doors for you. Leveraging your multilingual skills would be wise as well. You can likely find opportunities that require the ability to speak both your language, and ours. That puts you in a fairly narrow pool.


If a company is working on an outsourcing software development to 3rd party, you have to ensure that robust security measures are in place to protect sensitive data and code.  Check ISO 27001 is an Information Security Management Systems (ISMS) standard. It helps secure data and intellectual property management when applied to an offshore development context.

 

User generated image

 

Here are some ways ISO 27001 relates to offshore development:

 

  • Risk Management: To detect and evaluate potential security threats, ISO 27001 requires a risk assessment. This is essential in offshore development because several dangers include unauthorized access, IP theft, and data breaches.

  • Security Controls: Annex A of ISO 27001 lists 114 security controls [Annex A of ISO 27001: 2013 comprises 114 controls] [Transitioning to ISO 27001:2022 - The first significant change is the ISO 27001 controls list, previously 114, they are now 93 in the 2022 standard. Of the 114 controls, 35 remain unchanged, 23 have been renamed, 57 are grouped into 24 (for clarity), and 11 new security controls have been created]. When put into practice, these controls can aid in safeguarding information assets in an offshore development scenario.

  • Vendor management: In an offshore development project, the vendor or outside development company is an additional team member. Guidelines for managing the security of assets accessed by suppliers are provided by ISO 27001.

  • Data protection: Handling sensitive data is a standard part of offshore development. Organizations are required by ISO 27001 to have data protection measures, data life cycle, and data classification in place to guarantee the privacy, accuracy, and accessibility of data.

  • Business Continuity: ISO 27001 mandates the preparation of business continuity plans. This is relevant for offshore development as any disruption can lead to significant project delays.

  • Legal Compliance: Offshore development might involve dealing with data across multiple jurisdictions with varying protection laws. ISO 27001 can help ensure compliance with these legal requirements.

  • Trust and Credibility: An ISO 27001-certified offshore development center can offer clients confidence in their information security practices, which can be crucial in building trust.

 

 

https://csrc.nist.gov/Projects/ssdf

https://www.iso.org/standard/27001

https://www.itgovernance.co.uk/blog/iso-27001-the-14-control-sets-of-annex-a-explained

https://www.itgovernance.co.uk/iso27001-and-iso27002-2022-updates

https://www.experts-exchange.com/articles/37731/Information-Technology-Audit-in-Nutshell.html

https://www.experts-exchange.com/articles/37693/Zero-Trust-Begins-With-Identity.html

https://www.experts-exchange.com/articles/37654/Guidelines-for-Adequate-Cyber-Hygiene.html

https://www.experts-exchange.com/articles/37631/Transform-From-Trust-to-Zero-Trust.html

https://www.experts-exchange.com/articles/35333/RISK-ASSESSMENT-METHODOLOGY.html

https://www.experts-exchange.com/articles/33451/Building-a-Robust-Security-Awareness-Program.html

https://www.experts-exchange.com/articles/33288/Secure-SDLC-Principles-and-Practices.html

https://www.experts-exchange.com/articles/33330/Threat-Modeling-Process-Basics-and-Purpose.html

https://www.experts-exchange.com/articles/39303/ISO27001-From-Compliance-to-Certification.html

 


This question needs an answer!
Looks like this question is still being worked on. Think you can help?
Create your account and start contributing!
Create Account
Security

Security

--

Questions

--

Followers

Top Experts

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection. Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.