Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I have a fairly comprehensive understanding of a program environment (from machine to code), however I have limited experience actually programming anything. Is this something I really need to work on? or is conceptual understanding enough?

share|improve this question

5 Answers 5

You probably don't need to become good at programming in the large, but programming in the small is sure to come in useful both for automation purposes as well as for understanding what kind of situations can create security problems as well as what the potential effects of those security problems might be.

After all, not counting social engineering (which accounts for most security breaches), most security problems arise from some unexpected behavior of code -- and you should want to be able to read that code.

What language in particular you'd learn I can't say with certainty, but I'd look into something low-level like C as well as something more convenient like Python if you have the time. Either will give you enough understanding to read code in most other common languages, but C will expose you to the devils in the details, and something like Python is just handy to have as a tool, as Demian notes.

For your purpose, it's probably best to focus your learning efforts on becoming comfortable with reading code rather than on how to write good polished code.

share|improve this answer

It depends on the job naturally, but in general, no, I wouldn't presume it to be a programming position.

Of course, if you're programming the new ... I don't know, PGP encryption program, than some knowledge would be useful.

share|improve this answer

I'd venture to say that to flourish in the industry, you should be at least decent, the equivalent of a script kiddie perhaps (I'd personally want to be better than that though).

Generally (AFAIK), security experts will write scripts (bash, python, perl or whatever else they're accustomed to) to automate tasks (penetration tests, cron tasks, etc). Having the ability to hack something together to make yourself more efficient and your network more secure will definitely set you apart from some others.

Of course, to really understand what's going on in some areas, you'll have to have very low level system programming experience (assembly on target platforms) and understand (in depth) how your target OS works.

share|improve this answer

Watching the recent video of the Chaos Communication Congress presentation 'The science of insecurity' should give you a good clue about where you can start.

The presenter argues that insecurities come from incomplete parsing of inputs and/or inputs that are more complex than CFGs (or, CSLs, I tend to forget). Also, she stresses that it is a very bad idea to start processing the input before the whole of it is processed. If you relate to this level of thinking, you could start with theory of automata, parsing, Turing Machine, etc.

If you start at a programmer level, you should know to read a program and find out what kinds of inputs will make it behave weirdly and perhaps in undesirable manner. Popular browsers have a competition that awards the security expert who exposes such flaws.

share|improve this answer

Unless you are going to specialize in something like social engineering. I don't see how you can be a security expert and not be pretty good at programming! Certainly the folks trying to break your security are going to be programmers, or have programmers standing behind them. How will you be able to keep up with the bad guys unless you understand the tools they're using and the APIs they are targeting?

Or by "security expert" do you mean "I know how to configure a firewall/SQL Server/Oracle/Apache/IIS to conform with best practice for security"?

share|improve this answer
While a lot of security experts learn programming, it's often for quick scripting (and they pick up a language like Perl or Python) - especially when it comes to network and web application security. Often times, there are enough easy-to-use tools that you don't actually need programming in a day-to-day scenario. –  Bob Jan 5 '12 at 4:28
@Bob, Maybe we have different ideas of what constitutes an expert. When I hear "security expert" I think of folks like Bruce Schneier (schneier.com) or Martin Beck (dl.aircrack-ng.org/breakingwepandwpa.pdf). –  Charles E. Grant Jan 5 '12 at 4:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.