Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Gatherings for the Little Guys

Posted by timothy on from the do-lug-meeting-presentations-count dept.

NeedaFirewall writes: "With all of the recent vulnerability announcements and increased concern about terrorism, a lot of folks are starting to take security and privacy more seriously, both at the network and node levels. Large companies can afford to send their IT people to detailed technical security conferences offered by the likes of SANS, Blackhat, and others. Some of these cost thousands of dollars for a single seminar, class, or other event. Small companies and individual programmers, network admins, etc (like me!) often can't afford these. Where can they go to learn more about security? Are there quality security conferences, seminars, trade shows, and the like out there that the little guys can afford? Particularly broad-scope gatherings that can teach these 'security newbies' the basics and alert them to the most pertinent threats?"

7 of 187 comments (clear)

  1. Small budget security training by totallygeek · · Score: 3, Interesting
    This is interesting. Where I work they gave me a $7,500 security training budget for myself. I was faced with just the opposite problem -- where to go for decent training, and not just a "hang out" conference. I feel that I stay up to date via newsgroups, websites and tech journals.

    To answer your question, how about asking a nearby college or computer company? I hit up SCO once about security (many, many years ago), and was invited to one of their "internal" security classes for under $500.

    --
    Click here or here.
    1. Re:Small budget security training by Telastyn · · Score: 5, Interesting

      I'd also recommend spending some of the cash on a programming course if you've not taken one. Generally something in C would be best as it's one of the most common (and low-level and broken) languages. Understanding the bugs that can lead to exploits can help alot in understanding exploits themselves.

      Intro Cisco courses are also a great help in the same vein as the first bit of the course goes over networking details if you're mainly a systems admin, and aren't up to snuff on the details of networking.

  2. defcon - not just for the l33t by maestro^ · · Score: 3, Interesting

    defcon is becoming more 'mainstream' every year and is a good conference on the cheap. for $75 you get many tracks from newbie to uberhax0r. its also a good excuse to get out of the office and spend a weekend in vegas.

  3. Security is an illusion ... by Proudrooster · · Score: 3, Interesting

    When it comes to security, I have found that training classes and seminars are "cool" and "fun" to watch, but have very little applicability to the configuration at my local site.

    I share the same opinion of others. The best way to stay on top of security is to subscribe to Bugtraq. Other subscription lists like CERT and vendor specific lists, are always lagging behind (sometimes as much as WEEKS) since they tend NOT to announce a security issue until the vendor has a fix/patch available. Bugtraq is pretty close to zero day disclosure and is not vendor specific, thus you have to wade through the subjects to see if anything applies to your site. Additionally, BUGTRAQ is moderated which cuts down on the quantity and noise, unlike other sources which can become excessive.

    To subscribe to the list, send a message to:
    bugtraq-subscribe@securityfocus.com

    This is my securty mantra, "security is an illusion".

    If you are connected to the Internet, you can be hacked. All humans make mistakes and all code is written by humans. The best you can do is manage your risk and increase your odds of not being a hackable target by staying informed and being proficient in application configuration.

    My advice is to spend your training money on the specific applications that are Internet facing e.g. (RedHat, Apache, Sendmail, DNS, POP3S, IMAPS, Oracle, MySQL, CISCO IOS), make sure you understand the security configuration and hit it hard in the class. Application Security Mis-configuration and weak passwords are probably the number one source of Internet compromises. Often times if you have your applications locked down and secure, the security exploit of the day may be a non issue.

    Good Luck!

  4. read some books? by wobblie · · Score: 5, Interesting

    Well, first you must know tcp/ip very well. ORA's "Internet Core Protocols" is an excellent start and a very good book.

    The "hacking unix exposed" series of books are also very good.

    Forget windows. Get yourself a free unix and learn tcpdump and netfilter or ipfilter inside and out.

    Talking about learning security by going to conferences is kinda ridiculous, like expecting to learn archeology by going to archeology conferences.

  5. Best way to learn about security by uhlmann · · Score: 2, Interesting
    1. setup a box with default installation of an older distro
    2. turn on extensive logging
    3. connect to the internet
    4. wait...
    5. when cracked, do forensic analysis
    nothing can beat real life practice. it just needs time.
  6. USENIX!!! by Crispin+Cowan · · Score: 3, Interesting
    USENIX Security Symposium: not just more affordable than SANS, it's also better. SANS is baby-food for people with more time than money: nice, competent people RTFM to you out loud.

    In contrast, USENIX is actual security technology. Take the tutorials for in-depth learning on important issues, and the technical sessions for cutting-edge practical security research. We have a paper this year on the LSM (Linux Security Modules) project.

    Crispin
    ----
    Crispin Cowan, Ph.D.
    Chief Scientist, WireX Communications, Inc.
    Immunix: Security Hardened Linux Distribution
    Available for purchase