Well, I don't know if it's that clear. Knowing the math behind differential analysis or the reasons behind the values of AES s-boxes won't make you any better at assessing the standing of a web service or a daemon.
If it's not too technical, try finding some articles in phrack(.org) magazine. They usually outline the details of attacks and will let you see what vulnerabilities attackers take advantage of. If you want to stay technical, I'd look for exploits online and try to understand how they work. If you start at the defensive end, it might not be exactly clear why some counter-measures are in place and might be more dry than playing with something you can actually break.
Get a very old Linux install, disable ASLR, PaX, W^R and anything that might stand in your way and create write your first buffer overflow attack. Then try a a heap exploit. Then move on to more interesting things. Try to follow security conferences and the papers presented there. Attend security-related meet ups in your area. Idle in irc channels, etc.
