Stuart Stuart McClure is the President and CTO of Foundstone, a successful security author, speaker, and teacher. Stuart holds a B.A. degree from the University of Colorado, Boulder and numerous certifications including ISC2's CISSP, Novell's CNE, and Check Point's CCSE.

His latest book, Web Hacking: Attacks and Defense, was recently released and that was the perfect opportunity to get him to answer a few questions. Here it goes...

How did you become interested in computer security?

The interest started in college when a colleague of mine challenged me to discover his password. I brute forced his UNIX password over a weekend, and ever since then I have been hooked on security.

What are your favorite security tools and why?

Any tools that have to do with managing security and vulnerabilities. The challenge of finding vulnerabilities is not the biggest hurdle today, it is getting them fixed and managing the process of fixing them.

Do you feel satisfied with the success of "Hacking Exposed"? Did you get any negative feedback on the book?


The success of Hacking Exposed continues to overwhelm all the authors. Nothing but positive comments have come from administrators all the way to CIO's. The content hits a nerve for a broad audience and its success is testament to that fact.

What was it like writing "Web Hacking: Attacks and Defense"?

"Web Hacking" was fun in that it was satisfying to finally see this content being released to the public and web administrators. So much of eCommerce and web technologies seem esoteric and overly sophisticated for the masses. We wanted to bring the same highly technical content to the masses, and I feel we have done that with "Web Hacking".

What books/articles/whitepapers would you recommend to people that are starting to learn about computer security?

Anything and everything you can get your hands on. Check out www.hackingexposed.com for a small list of good books.

What are your future plans, both private and Foundstone related?

Plans are to continue to deliver quality security products and services to the market, and to be a voice for security management in all its incarnations.