I see on a regular basis IT security students coming here and asking advice on which subject they could choose to study.

There are hundreds of books, websites, blogs and tools around, so I understand it may be difficult to get an overview clear enough in order to make an informed choice.

However, such questions requesting for a specific list of suggestions are out-of-topic here for several reasons (hardly fits a Q&A format, deprecate very quickly, the answer will most likely be per-student, etc.) and therefore are quickly closed.

Nevertheless, since this issue seems to occur on a relatively frequent basis and it is a sane behavior for the student to seek for expert advice, I think it could be useful to have a post on this site they could find giving a few clue where they should start.

Once on the right track, up to them to go as far as they would like!

  • 1
    Perhaps better for Academia.se, as really the only answer infosec.se could give would be very broad? The selection process for a dissertation, thesis or proposal can be very specific to each questioner, even if the field is narrowed down to info sec. This is complicated further for undergrads who will need to keep it in the confines of their specific course structure. A security topic in particular may also have to be rubber stamped by some kind of ethics committee further muddying the waters and undermining any answer someone here could give. I understand your reasoning though. Commented Jan 9, 2016 at 15:51
  • 2
    @TheJulyPlot "Please suggest some research topics on X" is firmly off topic on Academia. We don't accept research topic "shopping questions." There are already some general questions there on how to choose a research topic: see e.g. How to select a Master's thesis topic if your advisor won't suggest one?, How to find a good topic for a PhD research proposal?, How to find relevant and new open research topics?
    – ff524
    Commented Jan 11, 2016 at 7:48
  • @ff524 Ah well that makes sense. Everyday is a school day if you pardon the pun. Commented Jan 11, 2016 at 7:55
  • @ff524: Thanks for the links, the answers give useful practical advice and most of them seem indeed to encourage to get a "birds eye view of what's going on in the field" by reading reference publications. Commented Jan 12, 2016 at 11:05

2 Answers 2


The problem I see is that there can be no single thread that could possibly answer the question, even broadly. Undergrad topics are different from PhD topics (we get people asking both), and the InfoSec field of study is as immense as the field of computing.

  • I'm clearly not addressing here people wanting to do specific research in a very narrow field: I suppose such people should already know their subject, if they don't they should consult their own community. I'm targeting instead people who just lack inspiration , would-like a more "current" or "practical/real-world" subject or need to get a step back before deciding. A direct answer would indeed take dozen of pages and obsolete very quickly, hence my idea to just provide search terms (which may not be so obvious to everybody) as a kind of entry point which is both short and does not deprecate. Commented Jan 11, 2016 at 10:32

The main issue here is that there is often too much information available: too much information kills the information.

Fortunately, this problem being not restricted to students seeking for a dissertation subject, large security companies invest time and efforts to provide a clear overview of:

  • Current trends in the IT security world (both from the offensive and defensive sides)
  • Perspective over the past activity,
  • Emerging technologies and challenges,
  • Links to main facts and events anlysis.

This seems like goldmine for such need. Even better, such report are freely available on the Internet and can be found by searching for terms such as:

  • cyber threats predictions
  • emerging cyber threats
  • cyber threats forecast

From there, I think that any student should be able to find a subject both motivating and suitable for his assignment, plus some argumentation elements to show to the professors why the chosen subject is relevant.

  • Searching for cyber threats is far too limiting. For the Master's thesis that I want to prepare, it "threats" has nothing to do with it, but is squarely in the realm of security. In my opinion, "where can I look to get ideas for a paper/thesis" is the broadest possible question one could ask here.
    – schroeder Mod
    Commented Jan 10, 2016 at 16:25
  • IT security is often defined as protecting assets against threats. I overviewed McAfee's report which appears among the first results, it seems to do a good job in covering each of these three aspects, answering questions such as "Which are new assets?", "What are the current and upcoming threats affecting current and upcoming assets?", "*What are the current protection systems and what upcoming protection systems are currently being actively researched?", even mentioning physical security threats for which there are no real solutions (either implemented or available) yet. Commented Jan 11, 2016 at 10:17
  • I believe that there may be some security related subjects which bother neither with the assets, nor the threats, nor the protection measures, but I believe that this scope may be at least large enough to provide a ideas to students lacking inspiration. Commented Jan 11, 2016 at 10:17
  • Sorry but I'm a student in security and the word "cyber" does not appear in any of my 170 pages of thesis :-) I think the field is too broad, and the relevant methods, theories and topics too numerous, for us to propose practical advice on where to learn about the trends in one of the many sub-fields of "information security". I'd just go with telling the students to read papers on a topic of their choice and figure out what the open problems are. It's so generic that I agree with others stating we shouldn't have a security-specific answer to that. Commented Jan 13, 2016 at 20:17
  • 1
    I'm also tempted to say that if people are asking this kind of question then either (a) they have nothing to do in research or (b) they are in an institution filled with people who have nothing to do in research. Either way I don't feel anything will come out of their dissertation that will be useful to others so it won't matter what it is on. Commented Jan 13, 2016 at 20:18
  • @SteveDL: Why not post your own answer ;) ? "Cyberthreat" is just a marketing buzzword these editors seem to have adopted as a norm and as a mere synonym of our "IT security". In fact we are quite far from the "cyberworld" when such report explain why we may expect a raise of physical attacks again employees at home or while traveling, highlight the urge to bring security into connected cars or analyze the threat level affecting critical civilian infrastructures. Commented Jan 15, 2016 at 10:33
  • @SteveDL: However I agree with your second comment, I'm indeed remembering me those students who were not very good with computers but very good at maths so got their diploma with no problem; I was always worrying what kind of IT engineer they would make (and I'm not even sure they would be very happy with their job too...). Commented Jan 15, 2016 at 10:37
  • 1
    @WhiteWinterWolf I require a certain degree of overall confidence about a topic before I post. I could blabber about that but could I actually authoritatively answer the question? :p I find it more appropriate to point out to the blind spots of one answer that has already quite a few elements put together. Commented Jan 15, 2016 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .