Go deeper
IT security
How systems get broken, and why the weak part is almost always the human, not the cipher.
Courses on this shelf
The reading track
- 01
Modern cryptography uses mathematical algorithms to turn messages into unreadable codes, but only if they are implemented correctly.
Applied Cryptography: Protocols, Algorithms, and Source Code in C · Bruce Schneier · 1994
Imagine you have a robot that mixes the letters of a letter according to a secret rule. If the rule is good, no one can read the letter without the key. But if the robot makes a small mistake, a clever enemy can guess the rule and read everything. So it is with computer codes.
Why it matters This book is essential for understanding how online security works today.
In full →Collapse ↑
A concrete example: when you open a secure website, your browser and the server agree on a secret code without anyone seeing it. If one step in this negotiation is wrong, an attacker can read everything you send, from passwords to messages. The algorithm is just a recipe; its implementation makes the difference between safety and vulnerability. The next step shows how a seemingly minor error can compromise the entire system.
- 02
Cryptography has been used for thousands of years to protect secrets, and every new method was eventually broken by creative people.
The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography · Simon Singh · 1999
Imagine you have a box with a secret lock. Over time, people invented more and more complex locks. But each time, a clever thief found a key or a method to open it. So it was with secret codes: each invention led to a new break.
Why it matters This book shows why information security is a continuous race between defenders and attackers.
In full →Collapse ↑
When you sent a message in ancient Rome, a slave carried your wax tablet. If enemies intercepted the tablet, they could read everything. So the Romans invented Caesar's cipher: they replaced each letter with another, three steps away. It worked for a while. Then opponents noticed patterns. The most frequent letters in Latin, like E, remained easy to guess. Thus the art of code-breaking, called cryptanalysis, was born. Every advance in defense triggered a counter-advance in attack.
- 03
Digital security is not just about passwords and encryption, but about understanding the whole system, including people and processes.
Secrets and Lies: Digital Security in a Networked World · Bruce Schneier · 2000
Think of a castle with thick walls and a drawbridge. If the bridge is accidentally left down or the guard is asleep, the castle is no longer safe. Similarly, a computer system has many parts: programs, networks, people. If one is weak, everything falls. You must look at everything, not just the lock.
Why it matters In the internet age, where everything is connected, this holistic view of security is more important than ever.
In full →Collapse ↑
Schneier says a system is only as strong as its weakest link. Often, the weak link is not a code or a server, but a person. An employee who clicks a malicious link can undo any encryption. That is why real security starts with education and organizational culture. Without vigilant people, technology becomes just an illusion of safety.
- 04
A password is a personal item of digital hygiene: it only works while it stays private and gets renewed, not a possession you keep for years.
The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage · Clifford Stoll · 1989
Stoll discovered an intruder in the university systems where he worked only because he refused to let a 75-cent accounting discrepancy slide, then tracked the hacker for nearly a year. His lesson is that everyday security lies not in exotic technology but in banal habits: shared passwords destroy any accountability, because you can no longer know who actually entered. The example from the book: accounts lent between colleagues were exactly the doors the intruder used for months.
Treat your password like your toothbrush. Don't let anybody else use it, and get a new one every six months.The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage — aforismul consacrat al autorului despre parole
Why it matters As a single digital account unlocks money, medical records and public services, basic password hygiene becomes a civic act, not just a technical one.
In full →Collapse ↑
A password is not just a key; it is a fingerprint. When only you use it, every login with it says something about you. Stoll could track a spy for nearly a year precisely because he could separate legitimate activity from foreign movement. Lend an account to a colleague and that clarity collapses: suspicious actions hide behind the name of someone who did nothing wrong. Think of a bank card: hand it to someone, and the bank can no longer tell which of you paid. A shared password does the same to your entire digital life. And if every small hygiene habit matters, a question follows: how often should this personal object actually be renewed?
- 05
The hacker ethic puts openness and hands-on learning above formal restrictions — a vision that produced both the culture of innovation and the problem of security.
Hackers: Heroes of the Computer Revolution · Steven Levy · 1984
Levy documents the credo of the first hacker generation at MIT: information should be free, access to machines unlimited, authority dismantled by competence, and beauty matters. The mechanism of the culture is simple: if you can take a system apart with your hands, you truly understand how it works, and knowledge comes from exploration, not manuals. His example: young people spending whole nights at computers to rewrite programs more elegantly, without asking anyone's permission. The book shows the tension born here: the same mindset produced both free software and system break-ins, because the line between «curiosity» and «intrusion» is ethical, not technical.
Access to computers—and anything which might teach you something about the way the world works—should be unlimited and total. Always yield to the Hands-On Imperative!Hackers, partea I, cap. 2 (Etica hackerilor)
Why it matters The debate over how open systems should be — from communication networks to source code — resurfaces with every incident. The ethic Levy described is the root of both camps.
In full →Collapse ↑
Levy describes a way of learning that seems obvious today but was radical then: don't read about the system, open it. Knowledge comes from touching, not from permission. The MIT hackers didn't study manuals; they rewrote programs and watched what broke. It's the same logic as a child taking apart an alarm clock to find out why it rings. We see it today in open-source culture: public code can be read, changed, and improved by anyone. But openness has a price. If any system can be taken apart, anyone can exploit it too. The question that remains: where does curiosity end and intrusion begin?
- 06
The weakest point of any security system is the human, not the technology, because people can be tricked into giving away secret information.
The Art of Deception: Controlling the Human Element of Security · Kevin D. Mitnick · 2002
Think of a very tall fence and a thick steel door. If the guard opens the door to anyone who says they are a friend, the fence doesn't matter. Similarly, an attacker can call and say they are from IT, asking for the password. The human gives in, not the computer.
Why it matters Today, social engineering attacks are among the most dangerous because they target real people, not machines.
In full →Collapse ↑
Mitnick shows that trust is the easiest vulnerability to exploit. An employee wanting to be polite can give access to a stranger. For example, someone calling and pretending to be a colleague who forgot their password. It is not technology, but human goodwill that opens the door. How can you recognize an attack before it happens?
Attackers do not force the door; they convince people to open it. An employee who answers a call from a fake IT colleague is not careless, but polite. They want to help. Mitnick calls this vulnerability the 'weakness of goodwill.' For example, an employee who confirms an email address to a supposed business partner actually hands over a key to an attack. How can you stay polite without becoming an open door?
Mitnick suggests that the solution is not to become suspicious of everyone, but to build simple verification habits. For example, if someone calls claiming to be from tech support, do not give your password right away. Hang up and call back the company's official number. This reflex turns politeness into a shield, not a door. The next step is to learn how to say no without seeming rude.
Mitnick shows that attackers exploit not just politeness, but urgency. When someone says there is a crisis, our brain skips checks. For example, a fake boss asking for a password 'now, because the server is crashing' triggers panic, not thought. The solution is to have a fixed rule: no important action without confirmation through another channel. This way, urgency becomes a warning signal, not a command.
- 07
A cryptographic system must not depend on the mechanism staying secret; the only thing that needs to stay secret is the key.
La cryptographie militaire · Auguste Kerckhoffs · 1883
Kerckhoffs analyzes military cryptography and draws a counterintuitive conclusion: a cipher does not become safer by being kept secret. On the contrary, a system assumed to stay hidden collapses completely the moment it falls into the wrong hands. If, instead, the enemy knows the mechanism and the only variable is the key, security reduces to protecting one small object that can be replaced. A public cipher, tested by many experts, earns trust through repeated failed attempts to break it. His example: an army with thousands of users cannot keep a procedure secret, but it can keep a key. This idea underpins modern cryptography, where algorithms are public and audited, while keys are private and regularly rotated.
The system must not require secrecy, and it must be able to fall into the hands of the enemy without inconvenience.La cryptographie militaire, Journal des Sciences militaires, articolul I, ianuarie 1883
Why it matters When an institution bases its defense on hiding its method, a single leak undoes everything; Kerckhoffs's principle explains why publicly verifiable security always beats security through obscurity.
In full →Collapse ↑
Here is what follows from Kerckhoffs' principle: secrecy is a resource that gets used up, a key is one that gets replaced. A hidden method cannot be repaired once it leaks; it must be abandoned from scratch. A compromised key, by contrast, is swapped like a lock after lost keys. Think of your account password: if it escapes, you change the password, not redesign your bank. That is why modern systems separate the two cleanly: the algorithm is fixed and public, the key is small and rotated regularly. But what does it mean, practically, for a public algorithm to earn trust? The answer is blunt: it becomes an open target. Experts attack it for years, and surviving those attacks is precisely its proof of worth.
- 08
The most expensive defensive technologies are useless if the attacker gets in through people rather than machines; the weak link is the human persuaded to cooperate.
The Art of Deception · Kevin Mitnick · 2002
Mitnick, a former notorious intruder turned consultant, argues that most serious breaches exploit trust, not technical flaws. The mechanism is social engineering: a caller who sounds like a colleague from IT asks for a password, an email that looks like it comes from a manager asks for a transfer. Technical defenses see nothing, because there is nothing to break into; access is simply handed over. The classic example in the book: an attacker calls the reception desk, poses as an employee who forgot his credentials, and receives the data within minutes. The practical conclusion is that training people, verifying identities through procedures, and a culture that permits refusing and double-checking matter as much as any equipment.
Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, and account for computer systems that contain protected data.The Art of Deception, cap. 1
Why it matters Today's most common attacks do not break ciphers; they politely ask for the data. The book explains why defense budgets fail when they ignore the human factor.
In full →Collapse ↑
Here is the new step: trust should not be destroyed, but disciplined. Mitnick shows that victims are not naive, they are helpful — they want to assist, and that desire bypasses procedure. So defense does not mean suspicious people; it means verification that is just as polite as the request. A caller claiming to be from IT can himself be verified: you call back the department's official number, not the one from the call. At reception, no one gives out details about an employee until you confirm through a separate channel. Refusal thus becomes a professional act, not a hostile one. The right culture says: checking is not disrespectful, failing to check is. One question remains: why do attackers still succeed, if the rule is so simple?
- 09
Writing good code is not just making it work, but finding the most efficient recipe, like a chef searching for the best method, not just one that works.
The Art of Computer Programming · Donald Knuth · 1968
Knuth carefully analyzed thousands of different ways to sort or search data, measuring exactly how many steps and how much memory each method uses. Some recipes look simple but become very slow with much more data. Other, more complicated-looking recipes stay fast even with millions of entries.
Why it matters His books remain, decades later, a standard reference for software engineers.
In full →Collapse ↑
Knuth teaches us that a method that works is not enough. When packing for a trip, you could just throw clothes randomly into the suitcase. It works, but it takes long to find something. A better method is to roll each item and layer them. This is the difference between a slow program and a fast one, especially when you have a lot to do.
- 10
People and computers rarely search for the perfect solution to a problem; they settle for one "good enough," because time and available information are always limited.
The Sciences of the Artificial · Herbert A. Simon · 1969
Simon called this bounded rationality: nobody can analyze absolutely every possible option before deciding. When choosing dinner, you do not compare every recipe in the world; you settle on the first reasonable option found quickly. Computer algorithms use the same strategy, searching for good solutions rather than perfect ones.
Why it matters The idea directly influenced how search algorithms used everywhere today are designed.
In full →Collapse ↑
Simon showed that, when information is incomplete, an acceptable solution is more useful than a perfect one. For instance, when looking for an apartment, you don't see all listings in the city, but stop at the first that meets your basic criteria. This observation laid the foundation for heuristic search algorithms, which don't explore all possibilities but guide decisions toward promising options. Online search engines work the same way, showing you only the most relevant pages, not all of them. The next step explains why this approach saves resources.
- 11
Artificial intelligence can be built through rational agents that perceive the environment and act to achieve goals.
Artificial Intelligence: A Modern Approach · Stuart Russell și Peter Norvig · 1995
Imagine a robot playing chess. It sees the board (perceives), thinks about which move to make (processes), and moves the piece (acts). This is the idea of a rational agent: a program that makes good decisions to win, just like a human player.
Why it matters This book is the modern foundation of artificial intelligence, used in universities to learn how robots and virtual assistants work.
In full →Collapse ↑
A rational agent does not have to be perfect. It makes the best choice based on what it knows. For example, a robot vacuum does not know where the dirt is in the house. It uses sensors to detect dust and decide which direction to go. Sometimes it misses a corner, but that is okay. Its goal is to clean as efficiently as possible, not to be perfect. That is practical rationality. The next step is to understand how the agent learns from mistakes.
- 12
Many systems — animals, machines, even cities — self-regulate by using feedback about their own results, the same way a thermostat shuts off heat once it is warm enough.
Cybernetics: Or Control and Communication in the Animal and the Machine · Norbert Wiener · 1948
Wiener called the study of feedback loops cybernetics: a system measures the effect of its own action and adjusts its behavior based on that effect. A thermostat reads the temperature, compares it to the target, then turns heat on or off. Your body does the same when it shivers.
Information is information, not matter or energy. No materialism which does not admit this can survive at the present day.Cybernetics: Or Control and Communication in the Animal and the Machine, Introducere
Why it matters This idea of continuous feedback underlies modern robots and the autopilot systems in aircraft.
In full →Collapse ↑
Wiener noticed the same feedback loop works in economics. When prices rise, people buy less, and prices fall. It is like a thermostat, but with people instead of sensors. The problem is that people react slower and more chaotically than a thermostat. That is why markets fluctuate so much. The next step is to see how these loops can be designed consciously.
- 13
Consciousness might arise from loops that refer back to themselves, the way a drawing of a hand drawing itself seems impossible, yet makes sense as an idea.
Gödel, Escher, Bach: An Eternal Golden Braid · Douglas Hofstadter · 1979
Hofstadter compared the mind to an Escher drawing, where a staircase seems to keep climbing yet returns to where it started. He linked this to Gödel's discovery: a system complex enough can talk about itself. Perhaps this exact kind of self-referring loop creates our sense of self.
Why it matters The book's ideas still influence research today into how consciousness might emerge in artificial intelligence.
In full →Collapse ↑
Hofstadter does not say any loop is consciousness. A thermostat has a simple loop: it turns heat on or off. But it feels nothing. The difference lies in complexity. When enough loops intertwine, something new emerges. Think of a chess game. The rules are simple, but their combinations create strategies no one foresaw. Similarly, loops in the brain might intertwine until the sense of self appears. The next step is to understand how many loops are needed.
- 14
Any message — words, images, music — can be broken down into the smallest possible unit of information, a simple yes-or-no answer called a bit.
A Mathematical Theory of Communication · Claude Shannon · 1948
Shannon showed you can measure information exactly like a weight, in units called bits. One bit equals a single yes-or-no question. String enough bits together and you can describe a photograph, a song, or an entire book, no matter what original language was used to create it.
Why it matters Every file sent over the internet today is, at its core, just a long string of bits.
In full →Collapse ↑
When you say 'yes' or 'no' to a simple question, you have chopped reality into pieces a computer can swallow. Think of an audio file: every second of music is measured thousands of times, and each measurement is a 'yes' or 'no' for a certain sound level. Just as a photo becomes a mosaic of dots, sound becomes a string of bits. But how do you know if that string is correct?
- 15
An imaginary, extremely simple machine that reads and writes symbols on an infinite tape can, in principle, compute anything any other computing machine ever could.
On Computable Numbers, with an Application to the Entscheidungsproblem · Alan Turing · 1936
Turing imagined a long tape divided into boxes, where a simple machine reads a symbol, decides what to do using fixed rules, then moves left or right. However simple it looks, this Turing machine can, in theory, run any program that today's most powerful supercomputer can run.
Why it matters His idea laid the theoretical foundation for every computer and phone in use today.
In full →Collapse ↑
Think of a washing machine. It has a fixed program: wash, rinse, spin. A Turing machine, however, can execute any program. It does nothing on its own. It simply follows simple instructions, step by step. This is the secret. Any complex calculation can be broken down into elementary operations. From a video game to a weather forecast, everything reduces to the same basic moves on an imaginary tape. The next step is to understand how such a simple machine can be as powerful as any other computer.
- 16
Alan Turing proved that some problems cannot be solved by any computer, no matter how powerful.
The Annotated Turing · Charles Petzold · 2008
Think of an impossible puzzle: you want to know if a program will ever get stuck, but you can't find out for sure. Turing showed there are questions computers can never answer, even if they are very fast. It's like trying to find a treasure that doesn't exist.
Why it matters This limit of computation helps us understand why some problems, like perfect security, are impossible.
In full →Collapse ↑
Suppose you write a program that checks if another program will crash. Turing proved that such a universal checker cannot exist. This means that no matter how smart you are, you cannot build a machine that predicts all crashes. It is like trying to create a complete list of all possible lies. In everyday life, this explains why your antivirus sometimes misses new threats.