Slashdot Mirror
Getting Started in Network Security?
pixelgeek asks: "Security has not only become an important topic but also a critical issue for admins and even the average user in their home. To someone new to the topic the wealth of material can be a bit daunting and, you can imagine, a little confusing. Does anyone have any suggestions on where to start getting a handle on the concept of network/computer security and what are the most important and useful applications (CLI primarily) that a person should examine and learn?"
We've touched on these issues before, but it was a while ago. Taking a network
security class, could help, but which classes are really worth the money and might there be enough information on the web to make such a choice, unnecessary?
Perhaps a BS in Applied Networking and System Administration could get you some of the answers you are looking for.
In security you have to have a well rounded education and experience simply because the job demands it. A good start would be probably 5 years in network administration with large user group enviroments, fluent programming skills (java, c, c++, perl), some experience in web server farm administration etc. I don't know any security or computer fornesic who worked for our company who is under 35 yo.
I found Zieglers book 'Linux Firewalls' useful http://www.amazon.com/exec/obidos/ASIN/0735710996/ qid=1053904217/sr=2-2/ref=sr_2_2/002-0456066-36248 65 ; also this is a great site http://www.linux-firewall-tools.com/linux/
Evil ZEN Scientist
SANS InfoSec Reading Room.
Learn everything you can about IP, TCP and UDP. Read the RFCs. Then learn about application level protocols like ssh, telnet, HTTP, FTP and the various mail protocols. Almost all vulnerabilities are caused by a system mishandling a certain type of message.
Admit nothing, deny everything and make counter-accusations.
O'Reilly has a good security bibliography here. Be sure to read Practical Unix and Internet Security (which is now in its third edition). Beyond that, pick some books that seem the most interesting to you.
Comment removed based on user account deletion
Written by Micheal D, Bauer, O'Reilly & Associates, ISBN 36920-00217
"Eve of Destruction", it's not just for old hippies anymore...
Allways remember - (re:CLI)
A PIX (Firewall) is not a Router and a Router is not a PIX
This little morsel of knowledge still eludes me continuously in my day to day work in this field.
---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
I find that while using OpenBSD, you get to learn a lot about security. ;)
The OpenBSD developers are security experts (and that's an understatement), and thus everything in OpenBSD is done the way it should be done, from a security point-of-view.
When you install OpenBSD, it's secure out-of-the-box. Of course no services are enabled by default. While you enable the ones you need, take the time to read through the excellent manpages (which are far superior in quality than linux's manpages), faq,... and you'll learn a lot.
Just don't expect no-brainer pointy-clicky interfaces *shiver*
And, interestingly, getting a job in network security requires a knowledge of network security, but having knowledge of network security without previous employment in the field can make you suspect.
Worst of all is to admit knowledge of security in a corporate environment by pointing out flaws--then you're an easy mark for those "in charge" of security, whom you've made look bad. Like a bad "in Soviet Russia" joke, security problem report you.
Fortunately, I haven't learned any of this by experience, only by obeservation.
CEE5210S The signal SIGHUP was received.
Security is unlike any technical discipline because it is not a technical discipline. When you try to make a web server work, your "enemy" is simply entropy. You learn what you need to know about how the technology works, and you are good to go.
In security, your enemy is another human being. This changes everything. What do you have to know? More than the best cracker you will go up against. The question is not, therefore, what do you have to know, but what don't you have to know. The only effective teacher of security is experience. If you try to play fresh out of college/certification mercenary in the security game, you will get your ass burned.
Security is not an Engineering discipline. Knowing one security tool, or even many tools does little or nothing towards cultivating the approach, process, culture and awareness-in-context that are basic to a professional in the Information Security field.
One could do worse than browse the documents collection in the Reading Room at SANS.org,and the archive of Bruce Schneier's Crypto-gram newsletter.
If Information Security still appeals to you, and you can specialize in an area suited to your temperment -go ahead.
"Flyin' in just a sweet place,
Never been known to fail..."
Try "Network Intrusion Detection: An Analyst's Handbook" by Stephen Northcutt.
"Know your Enemy" from the Honeynet Project
Experiment with the following programs:
Snort
Ethereal
IPTables
TcpDump/LibPcap
Follow articles/join mailing lists at:
CERT
Securityfocus
Examine analysis of the Scan of the Month Challenge at the Honeynet Project website.
Get yourself CISSP reference texts and generally increase your knowledge. I believe Cisco now has a few Security based certifications as well YMMV.
One of the most important things to remember is that security isn't all hackers and breakins and tiger teams and forensics. The day to day life of a security analyst (at least at a big firm) is fraught with arguments from operations, from development, from management. A very significant part of your job will be to propose The Right Thing To Do, which will almost always cost more and be more complex than the average Mickey Mouse bandaid solution that people tend to come up with. Security absolutely has to be designed into things from the start, not bolted on at the end. Execs and developers don't like to hear this a lot of the time, because it might cost more. Operations hates to hear it because it means they have another box to administer (a firewall instead of just a router) or some procedudes that require them to have accountability.
Definitely develop your people skills. You'll spend a LOT of time trying to convince people that you're worthy of what you're saying, but once you do they'll start coming to you before they do stuff and it gets a LOT easier. The important thing is to convince people that you're not just here to be an asshole and cost people money. That's the image the average security organization projects, but it's really not the case.
Like others have said, learn as much as you can about as many technologies as you can, rely on other experts in the company for depth of knowledge, and you'll be fine. You don't have to be the ultimate CCIE router nerd to perform decent network security. You need to know how and where to research things, how to communicate those results to the people that need to know them, and how to stick to your guns when needed. You won't always win. Management is funny like that. But if you're creative in finding solutions and very firm and confident when you do have to deliver the bad news, you're well on your way to being a decent security analyst.
Everything depends on what your security concerns are. The expertise needed to secure a small home LAN against high-schoolers with too much free time is a lot different then the experience needed to secure a gigantic corporate WAN against determined crackers, and the training you need to do one is nothing like what you need to do the other.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
A great primer on some of the fundamentals of the field, along with a few of the more common attacks (mind you, any technique you find in a printed book is liable to be slightly behind the cutting edge.)
Might want to check it out: MIT Network Security Team
"On the following pages you will find information about protecting your computer or network from malicious hackers, dealing with a suspected attack or system compromise, and MIT network security policies"
Whenever the offence inspires less horror than the punishment, the rigour of penal law is obliged to give way...
Link
This book covers more than I could have hoped for. Since reading this book and following it's suggestions I've made my systems significantly more secure. You've still got to keep up with your software patches but if you've done a good job hardening your system, you get more time to implement the patches before the shit hits the fan.
Or at least that's how it's worked for me!
at their Networkers conferences in Orlando and L.A., including one entitled 'How to Think Like a Security Administrator When It's Not Your Full-Time Job'.
More details here.
http://www.insecure.org/tools.html
More in depth overviews:
any CISSP/GISC/Security+ certification book (plus, after reading it go get certified!).
Topic Specific:
Firewalls (contrary to what others may tell you, there is more to security than firewalls). Some good books: the O'Reilly Firewall book, Building Linux and OpenBSD Firewalls (a bit dated but still on topic).
Do a search for all O'Reilly books with 'security' in the title/description, flip through it, decide if it suits your need (e.g. Web Security, Computer Security Basics, OpenSSL security, etc).
Learning the topic *really*well* is very important - e.g. really understand TCP/IP (something beyond "i plug in the cable, run dhclient, and i get internet!") andlook at it with an eye for security. Same goes for web server, general sysadmin tasks, programming, etc.
Remember: security is a process. and a moving target. and impossible to fix %100 but try anyways.
Experience is essential too. Get yourself an experimental network and try attacks, network sniffing, securing, MiTM'ing, getting around firewalls, DoS'ing, snort'ing, arpspoofing, etc. Once you've run some attacks then you'll have a working idea of what is going on and will hopefully be able to see when a line of thought would lead you in the same direction in setting up your network. Plus it helps to know you could set up a quick demo to show how easy it is to sniff someone's password, even on a switched network.
Become a keen observer of people. The users are your number one enemy in terms of security. They'll give their password away to anyone, try to thwart your attempts to secure the network, print out and take confidential docs to the cafe, etc. Not on purpose, but b/c their priority is getting work done. Understand them so as to best work with them.
And there's a whole lot more, but most importantly remember that security requires a very robust approach. Not just a firewall, not just encrypting everything, not just checking all code, but a well thought out approach that is followed, revised, updated, explained to all employees, etc etc
-f
www.blackant.net
Amen brother. If you're starting out in your parents basement, tcpdump is your friend. Rudamentary C skills are also important.
How small a thought it takes to fill a whole life
2) A lot of the security industry is based on trust, even though the people that are in it aren't supposed to say that (it's not PC or something). Getting to know the people in security groups and showing them that you're trustworthy is the best approach. I would take someone who's reliable and trustworthy and can learn new stuff any day over someone who's an absolute iptables/snort wizard but has a chip on his shoulder about "enterprise" software and can't keep his mouth shut about sensitive matters. Security is definitely not the field for someone who enjoys frequent casual gossip about their job.
A CISSP book (and maybe a copy of ISO17799) should cover everything you should need to know.
The rest is just details, which you should endevour to become an expert in as/when needed.
Dom
(PS. A good CISSP book is >500 pages)
When you're dealing with risk analysis, it doesn't matter what protocol or application you're protecting. You only have to deal with your definition of risk. Typically, something like: If you're dealing with human threats, then you might use MOMM (Motive, Opportunity, Means, Method) to break it down.
You should also learn other ways of breaking down the anslysis, like the McCumber Cube, the laws that you can use to prosecute perpetrators, oand what you need to do so that you're not sued for monitoring your users (which might be a violation of various privacy acts).
Applications aren't nearly as useful, as well, they might help you on that whole 'detect/protect/correct' front, but they rarely lock down a system completely -- you need multiple layers of protection, from not only technology, but you need the policies so you can actually implement good security practices, and you need to train your employees so they aren't creating security problems. [quite a few books claim that the majority of security incidents come from inside a company, and users will give up authentication information with minimal prompting].
blah, blah, blah...you get the idea...
take a general overview, and work from there. .
Build it, and they will come^Hplain.
I'm seeing a lot of comments here that say "Set up your own firewall" or "Learn TCP".
Repeat after me:
Security != firewall
Security != networking
I see this misunderstanding all over the place, but you can't secure a system through the network only. And you certainly won't make it in the "security industry" if that's what you think.
It's a cliche, but security is a process. It starts at the design of <whatever> and never really finishes. A security expert will know enough about each step of the plan that he/she can guide the team to the implementation a secure enough solution to their part of the problem, whether that solution is software or a business process doesn't matter.
I say secure enough on purpose because a truly secure solution is not possible. And this is really another key part of the security experts arsenal - knowing when the cost of more security outweighs the cost of the risk/exposure you're covering up.
mod me down as a troll, off-topic or whatever, but I don't understand the ask slashdots when people ask 'how do I begin learning [something]?"
google for the topic, find a book, or a how-to, or whatever and start reading. inevitably you will come across an idea, or jargon, that you don't understand. so google for that. continue until you finish the book.
then find another book/how-to.
all you need to know is avoid books like 'advanced topic X'.
i dunno. maybe i'm just a supergenius. but most likely not.
learn, baby, learn.
"when life gets complicated, I like to take a nap in a tree and wait for dinner" - Hobbes.
True firewalling is a good start, but consider knowing good OS practices too, liking patching up and hardening Solaris, using tools like HFNetChk and others to help harden Windows, up2date and hardening RedHat Linux. Sure that's not all operating systems, but it's a good start. Disable services you don't need, secure the ones you do want to run, and so on.
Understand firewalls, NAT, port forwarding; set up an internal LAN mess with doing scans with nmap, try and do some things with nc...
set up things like ssh and scp in place of telnet and ftp. Know about the different forms of encryption their strengths and weakness, when one might be appropriate over the other.
Learn about VirusScan. Maybe McAfee VirusScan and NetShield and centrally administrating it with e-Policy so that you can automatically update all your servers and clients in case of an emergency DAT rollout cause of the latest virus running amok.
Also mail scanning, spam filtering, maybe things like clearswifts mailsweeper product, content filtering, lexical scanning, and other stuff.
Learn to set up postfix and sendmail so that they aren't acting as open relays, etc.
You might also consider something like Websense for URI filtering. Often not only are you trying to keep the bad things from getting in but also your users from getting to harmful material as well; in essence protecting them from themselves.
And of course you can mess with IDS, like say snort.
Learn about IPSec VPN's I'm sure there is free stuff to get you started, also learn about the big players in VPN's like say checkpoint, nortel networks with contivity, netscreen and probably lots of others.
Security only starts with a firewall. It also demands good practices with server updates and patches, mail scanning, web content scanning, virusscan, choosing secure methods over the easy ones....
Some of these programs are free, some you can download demos of, others you may not be able to get your hands on until your in a position to use them, but at least knowing about the different methods of making a network more secure is at least a start.
I still contend that you can not find a job worth jack, armed with knowledge of IPTables. Nor will you know enough to generalize about network security issues.
It may be a good tool in your kit. It better not be your main one, heaven help you - your only one!
If you were to suggest - for NETWORK security, only one single open-source or free software tool, why wouldn't is be Snort? Or even Nessus?
"Flyin' in just a sweet place,
Never been known to fail..."
First off, computer security is much like many other forms of security, at the concept level. The particulars of implementation are very different, but the underlying motives of the players and the interactions aren't. The infamous 419 scam was originally done in person, then by phone, and then by fax before it was possible to do it via email, for example, and lesser variants of it (the pigeon scam, for example) have existed in the offline world.
If you're looking to grasp home user or end user security, the first thing I'd do is buy The Gift of Fear by Gavin de Becker. Right off, that will give you a good understanding of intuitive threat modeling for everyday life. Unfortunately, I can't find a book out there that does home-user security for the average joe, nor can I find a class...but I am writing a book myself.
If you're interested in security from a more admin-oriented perspective, I would go to SecurityFocus and check out some of their mailing lists. At first, the material may be over your head, but you'll find that that only pulls you up a bit. Also, get yourself a linux box and learn linux (if you don't already know it). Set up a honeynet and see what's going to happen to an unpatched, exposed box. Or just set up snort with ACID as the front-end console to observe the attacks that are taking place. Once you understand the threat, it becomes a lot easier to decide what to study to defend against it.
For your security, this post has been encrypted with ROT-13, twice.
1. Use a dedicated firewall - I don't believe a fire wall on the machine you are trying to protect is sufficient, especially windows. Get either a router with a built in firewall, or use linux with iptable masquerade firewall. The latter option is more $$ and more trouble than the former, but I think it's untilmately more robust. You should also use a firewall on your PC, just in case.
2. Secure your browser and mail reader - these are the primary "back doors" into your computer. No firewall will protect you if you download and execute a virus attached to an email message. Sorry, no links here, but ask around, and becareful what you download.
3. Read up - Building Internet Firewalls is excellent for the novice. I have their simplest system at home - one dual homed PC that acts as NAT, firewall, and router. Not as secure, but good enough for me. Then just start reading more books as you have time. The O'Rilley series on Ethernet and the various TCP/IP protocols is good, and so are the relavent RFCs. But also consider more academic books like Comer.
When I started playing around with Linux five years ago, I had no understanding of 'real world' network security. Today I consider myself quite knowledgeable on the subject; I oversee network configuration and security for several LANs (including my own business); I've written academic papers on the subject and I am currently involved with university research in networking.
Learning any complicated system is an iterative process. First get started, then keep the ball rolling. I started by setting up an internet connected linux server in my basement, which immediately got hacked. Then I read up to understand how it happened; I started reading USENET groups like comp.os.linux.security and I rapidly gained a pretty good idea of what was going on.
The benefit of playing around with linux is that you immediately have access to all the major tools and technologies that power the internet - and can tinker around with them. Get slackware, and play around with iptables (firewall), ssh, apache configuration, mail, and all the other fun stuff like unix permissions!
Other ideas
The best way I know to measure something is to test it, and the best methodology I know of to test network security is the Open Source Security Testing Methodology Manual (OSSTMM).
You can download the latest version from http://www.osstmm.org. The latest is 2.0, although the 2.5 version has been slated to come out VERY soon, so check back in the next week or so for the update.
The OSSTMM is the most widely used peer-reviewed "Open Source" security testing methodology in existance. It is contributed to by security testing professionals all over the globe. It is definately worth checking out.
Although the OSSTMM does an excellent job at defining the "What" to do in a security test, ISECOM also has created two courses to teach the "How" and the "Why" in more detail. You can find out more about the OPST (the in the trenches tester/technical course) which teaches how to get the information for an OSSTMM based security test, and the OPSA (manager/analyst) which teaches how to analyze the information and manage the testing team at ISECOM's main site: http://www.isecom.org.
*disclaimer*: I work for a company that is partners with ISECOM.
Other ideas
"Weapons should be hardy rather than decorative" - Miyamoto Musashi
I think that goes for OS's too
I agree that googling has to be the first step, one that some "how do I . . ." posters clearly haven't taken. The answer is always the same as well - you will have to read a lot, start at the beginning, and work hard, that's how it's done. That said, only a person can show you how knowledge is applied, and I appreciate the responses and advice people give. Some of y'all are true badasses in your particular branch of IT and your time is worth serious money, so I'm thankful that you take a minute to give your opinion and maybe a little direction. It's what makes open source work and it's why you keep reading Slashdot.
Aww shucks, I feel all warm n' fuzzy inside
Real world experience is where its at. Know your packets first and your policies second - but keep in mind that both are equally important.
I've met plenty of tools that have "jumped into security". They try to talk a good game of the which type of firewall is better than what, and why PKI solves or doesn't solve everything. In reality they don't know squat and have even less of a clue on how to apply their solutions to the real world.
The best general network security people I've met are those who understand the systems they are protecting and have the power to tell management and developers 'no'. But apply it only when they absolutly have to. Business has to get done - but when the cost of doing that business unnecessarily puts your assets at risk, it is imperative to have the power to tell people no.
Books, classes, certs all have some value - but for me... if I'm not sitting there dealing with it, configuring it, and applying it to a homemade or real world situation... I'll never get as much out of it.
http://windows.scares.us
Fook, don't hit preview then the back button on your browser. :-(
Ok, time to summarise my longer post.
Background: I've worked in security professionally since late '99. I started with Unix and *cough* hacking back in '96.
1. Subscribe to security mailing lists: Best place to start with this is from www.securityfocus.com. These guys have lots of good lists to get onto - including Bugtraq.
2. Work (at home) with the systems you're likely to work with: This means building a home network, running up some unix servers, windows servers, a managed switch (try to find an old one).
3. Get some good books: For introduction to firewalls - "Building Internet Firewalls", for security design - "Security Engineering: A Guide to Building Dependable Distributed Systems", for crypto - "Applied Cryptography". There's heaps more, but those are some good starters. A good all-rounder is "Secrets and Lies" from Bruce Schneier.
4. Learn to hack: My motto for security work is - "You've got to know where the holes are in order to fix them". This means learning what those holes are, and what are common types of security vulnerabilities and threats are out there. The best way to do this (IMHO) is to start hacking your home systems. Grab Nessus (http://www.nessus.org) to begin with, and work from there.
5. Learn to program: You'll eventually get to a point where you want to develop your own tests, checks and scripts that available programs don't provide. If you are feeling game, try to write your own sniffer with libpcap (http://www.tcpdump.org) or your own scanner with libnet (http://www.packetfactory.net/projects/libnet/)
6. Teach yourself: I don't have much faith in security courses out there, primarily because I have had to work with people in "security" whose only experience/qualifications are a certain firewall certification (glances sidewards at Checkpoint). But if you need it to break into the market, go for it - just don't rely on it entirely. I don't have any real certifications, but I have practical experience with the top firewalls out there (most common security job is firewall admin), heaps of Unix's (solaris, digital, aix - and the various *BSD's and Linux), and can also do some programming. If you're going to work for a good company, they'll be more impressed with your skills than your certifications - though they help differentiate you.
Hope this helps.
Man watching 6 MSCE's around a sun box, looks alot like the opening scene's of 2001:space odyssey...
Set up your own Linux firewall with iptables and create your own rules.<sigh>
Network security is slightly more complicated than simply using iptables. Packet filtering is important, but recognizing possibile vulnerabilities in exposed services is also important. (For instance, did you know that -- by default -- most SSHDs allow any authenticated users to establish TCP connections to arbitrary remote machines? This can easily let users, regardless of how much you trust them, punch holes through your firewall.)
Furthermore, another large part of network security is network design. I've seen networks that have two or three DMZs, each guarded by independent machines with different configuartions: authentication systems, CPU architecture, and operating system (i.e. one OpenBSD, one Solaris, one <ack> Windows).
Continuing, most good network security folks can work on either side of the line between attacker and defender. Network security can only be built when you have learned to think like an attacker. (If I expose this port, what can that reveal about my configuration? What happens if this particular protection fails? What could happen if there was a root exploit on server 834?)
Sadly, there are many "security experts" that agree with you.
I would never suggest only *one* tool.
But that is besides the point. Learning iptables is much more *fundamental* than user-land tools. When you understand what is going on at the packet level, then, and only then, does it make sense to deploy higher-level tools. If you don't have your firewall properly configured, you are going to be looking at all kinds of crap with other tools, which may lead to confusion and mis-configuration problems, actually opening up your network to security exploits.
You are being MICROattacked, from various angles, in a SOFT manner.
The market is flooded with qualified people who can't find a job. Why would someone choose to enter a career that is so dismal?
Nick Powers
Encryption: I may not agree with what you say, but I will defend your right to encrypt it...
"Can you teach me how to hack?"
"Do you know what IP subnetting is?"
"Uhh, no. I don't care about that, I just want to break into people's computers!"
"Go away."
I hear this all the time, and it probably applies to the other side of the fence as well. Learn how stuff works and the theory behind it. If you don't know the difference between TCP and UDP, don't try to learn how to do system administration and network security - learn how networking works first. Learn the protocols. If you don't know how to check your POP3 e-mail and retrieve a web page with nothing more than a telnet client, learn how to do that and more. Then you can decide whether security is even where you want to go, or if another path presents itself.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
IMHO any information security professional needs to develop a professional paranoia, being thoughtful of potential risks and failures, and understand what might go wrong.
Reading Bruce Schneier's Secrets and Lies is a really good start in this area. It is a not very technical book, written at the level suitable for an IT manager. This is also useful to help explains risks, vulnerabilities, and failures to IT Management.
The ever so ugly covered Hacking Exposed, which explains the basics of what criminals (or attackers) do commonly to gain unauthorized access to (networked) computer systems. This is so you a) know how easy it is, and b) are familiar with an overview of the basic steps and techniques to gain illicit access.
For online resources, RISKS digest (not focused on malicious activities, but how systems fail - very insightful and low volume), and Bugtraq a full disclosure mailing list will show you recent exploits, and vuln notices, but it is fairly lacking in actual educational content, and there are several other mailing lists at SecurityFocus that could also be useful to developing professional paranoia.
Next you need the language and basics of information/computer security. For this textbooks like Computer Security by Dieter Gollmann, Information Security Management Handbook by Tipton and Krause, Practical Unix & Internet Security by Simson Garfinkel, Gene Spafford, Alan Schwartz, and Security in Computing by Pfleeger and Pfleeger.
For procedures look at CISSP study material, BS 7799 / ISO 17799, and security auditing and incident handling materials. Some knowledge of risk management can also be useful.
From these basics, of the right mindset, the common language of infosec, and procedures and policy you can get into the low-level details of firewalls, VPNs, IDS, and network design. For this you should have a good network/internetworking basics, a very detailed understanding of TCP/IP, and understand firewalls, VPNs, and IPsec.
Firewalls and Internet Security: Repelling the Wily Hacker, 2nd ed. by William R. Cheswick, Steven M. Bellovin, and Aviel D. Rubin is a great place to start, and Building Internet Firewalls by Elizabeth D. Zwicky, Simon Cooper, D. Brent Chapman is a great follow-up. An alternative book on firewalls and VPNs is Inside Network Perimeter Security: The Definitive Guide to Firewalls, VPNs, Routers, and Intrusion Detection Systems by Stephen Northcutt, Karen Frederick, Scott Winters, Lenny Zeltser, Ronald W. Ritchey (crowd from SANS).
For networking basics, a Cisco certification like CCNA could useful in providing knowledge about internetworking and Cisco router's IOS. For the gory details of TCP/IP either TCP/IP Illustrated: Volume 1: The Protocols by Richard Stevens or Internetworking With TCP/IP Volume 1: Principles Protocols, and Architecture, 4th edition by Douglas Comer.
For IDS - Network Intrusion Detection: An Analyst's Handbook by Stephen Northcutt and Intrusion Signatures and Analysis by Matt Fearnow, Stephen Northcutt, Karen Frederick, Mark Cooper are the best IMHO.
I am not sure what to recommend for VPNs, other than you need to know about IPsec.
Your best bet is to pick up a few books and then build a cheap test lab where you practice setting up different scenarios as well as trying to run various exploits to break into the machines. I.e set up a windows server, linux web server with apache and sendmail and see if you can break into them. Some books I recommend are TCP/IP illustrated vol 1, hacking exposed (all of them), Building Internet Firewalls (2nd edition) and a great non-technical background book is one by the godfather of crypto, Bruce Shnier called "Secrets and lies". Hope that helps Happy networking!
_+_+__+_+_+_+_+_+_+++
when i moo u moo - just like that
Let me start out with some orthodoxy someone else stated:
Security is a process.
Not something you can bolt-on, buy, or issue a memo on. Beyond that the learning resources mentioned by other posters are all good if not overkill. http://www.insecure.org/tools.html was covered in another article earlier this month.
But let me add a bit of heresy:
You don't have to be an uber-geek to do security, merely figuring out how to be properly secure against skript kiddiez will cover most cases, and the rest are more likely from internal threats - negligence or malice. And there is no anti-social engineering CLI or GUI tool.
Currently, the most common practice it to fire, buy-off, or otherwise silence the "whistleblowers". This is the police state model. So flaws continue since reporting them gets you in trouble with everyone including your boss. The monoculture "corporate load" takes care of everything. (monoculture in the agricultural sense, and in the most narrow one where every stalk of corn is a clone of all the others so one blight can destroy the whole like happened in Ireland in the late 1840s).
There are enough tools to detect and contain break-ins and outbreaks, but a CDC epidemiologist is probably a better model than a KGB officer. Use surveillance and containment, but unless someone insists on being "Typhoid Mary", ignore the user's idiosyncrasies and just make sure things get done.
You don't need to do cryptanalysis for the process to work, buy you need to have some people skills and have a corporation that understands what and how much they are asking for. You also have to take care of details like security patches and deleting old accounts and doing normal auditing.
The most common problems are that they want to be both secure and transparent. This is a tradeoff. And barring that they want to use Brand X software to "solve all their problems". Brand X may be good or bad, but processes create layers and usually Brand X only handles one layer, or can't handle some cases gracefully (abandon security or transparency in that case).
One other difficulty is that the average corporation doesn't really know about network security. They assume because there have been no detected attacks or other problems that there is no problem. Or the "process" is split and is part of an ongoing turf war between the guards insuring you have a visitor's badge and the IT department that has to do this as part of the gazillion other things they do. This usually creates policies but not the process.
If you want to get started, start by securing your home Internet connection. This will benefit you and the Internet community in general. I have a page with some information on home broadband security.
When you move to security in a business environment, in my opinion you need to frame security as a tool for risk management. CERT provides good information on handling security professionally, including their book The CERT Guide to System and Network Security Practices and a large collection of Articles, reports and papers.
Information Security Magazine will give you a sense of where the infosec business is going. On the academic side there's the new IEEE Security and Privacy Magazine and the IEEE Computer Society Technical Committee on Security and Privacy. Also on the academic side there are the more established journals from compsec online.
Does anyone have any suggestions on where to start getting a handle on the concept of network/computer security and what are the most important and useful applications (CLI primarily) that a person should examine and learn?
First you must understand that security doesn't really exist. It's all about mitigating risks and setting priorities. You just can't close every hole. The basic steps are simple:
1) Define what needs to be protected
2) Identify the potential threats
3) Prioritize (focus on most likely threats)
4) Put obstacles in place to slow down the attack
5) Monitor and react
6) ???
7) Profit
If the obstacles you put in place in step 4 slow the attacker down enough for you to react in step 5, step 6 becomes irrelevant. Step 4 and 5 is where the technical part comes into play and you can have all the flashy tools you want...but if you aren't any good at 1 and 2, you will fail. To answer the second part of your question, there are many tools out there. It's a "horses for courses" situation. What works in one situation might not even be considered in another. A good working knowledge of the relevant platform is more important than third party tools. Often, the right tool for the job is already there.
All very good for the beginner, for sure.
Don't forget tripwire, nmap and Nessus. I find Nessus particularly interesting, especially if you have more than a modicom of network experience under your belt.
I think security is the one area of the IT industry that's growing. Thanks, Microsoft!
Soko
"Depression is merely anger without enthusiasm." - Anonymous
Not only will it secure your box, one of their major goals is to "teach" you how as it does it. Here's a quote from their site:
Seems like a good source of info to me. Teach a man to fish and all that...
There is actually a 3-part Cryptography course (the 1st part of which is merely entitled, "Network Security") that I intend to take the 2nd two parts of pretty soon here.
Since timing will not allow me to take the entire sequence, I'm covering the material of the first course on my own.
To that end, a few resources:
[the following presumes a background in network engineering, the protocols, etc.; it also presumes some number theory but most of that is covered as needed]
1. For starters: Charles & Shari Pfleeger's Security in Computing, 2nd Edition -- this is a nice, intro text for high level (a) security, (b) encryption, (c) OS security, (d) DB security
2. Then move onto more specific texts, i.e. Silberschatz's Operating Systems Concepts, 6th Edition -- this provides a much more detailed look into OS security -- mechanisms/policies/implementations etc.
3. Then there are a couple wortwhile Cryptography only texts: (a) Schneier's Applied Cryptography, (b) Menezes' Handbook of Applied Cryptography
4. Then there is a good course website for the course I referred to, the 1st in the series of three that also has downloadable handouts as well as some coding projects that you could do independently, providing an enviro
5. Finally, I'd suggest a subscription to the Counterpane Crytpogram newsletter -- found at this link. Also, checking out this site periodically or perusing it somewhat in-depth will give you far more visibility into day-to-day threats.
Those who give up their power willingly deserve none.
1. Don't install Telnet, TFTP, RSH, RLOGIN or anyother clear text services. /var/log).
2. Disable remote root login.
3. Use IP Tables and TCP Wrappers.
4. On "gateways", bind services to local interfaces only.
5. Use a strong password.
6. Don't install unused services (Example: Do you really need a BIND or SMTP server on your laptop?).
7. One word... up2date (www.redhat.com).
8. One word... www.chkrootkit.org.
9. Monitor your log files (seriously all of them
10. Anything windows based is a security nightmare (and no that's not a troll).
And don't forget about all the great _free_ tools out there: nmap, ethereal, tripwire, logwatch.
Google search for any of the above pointers that are not slef explanitory.
Karma: The shiznight, mostly because I am the Drizzle.
-Start with a good understanding of the technology with sys-admin's experience.h tml first.t
l l-availability.htm
-Read TCP/IP Illustrated Volume I
-Read Applied Cryptography
-Read Hacking Exposed 4 (shameless plug) or other similar books directly related to hacking activities and have a good networking security section
-Install an old OS version and hack it, understand the flaw and how to fix it.
-Understand and be comfortable with coding.
-Understand the purpose and how to use these well know tools http://www.insecure.org/tools.html
-Pass the CCNP and CISSP tests, I would expect this of any good consultant.
-Ask questions, but read http://www.linuxsilo.net/docs/smart-questions-en.
-www.cymru.com
-phenoelit.de
-qorbit.ne
-Mailinglists
-bugtraq
-nanog
-isp-security
-checkpoint
-CERT
-first.org
-honeypot
General Topics to understand first hand, and experience.
-Firewall
http://www.qorbit.net/documents/maximizing-firewa
-IDS
-Dynamic Routing
Internet Routing Architectures - Bassam Halabi
-IPSEC
-SSL
Create your own CA, understand the downfalls of our current system
-Token based authentication
RSA and Authenex have free demo packages
-DNS
-packetstormsecurity tools
Try and CONTRIBUTE to non-corporate activities; specifically the opensource community
-VPN
-GLB, HIPPA, FIPS security policy
-Wireless (not just 802.11a/b/g) Security Methodology
-General Cryptography Overview
Know the pro's con's of using AES instead of 3DES for exmple.
Most of all, try and understand things from scratch, read old exploits and advisories and understand the exact source of problems. I've attended and taught several security courses; none of the 7 day security braindumps will make you an expert consultant, you need to think outside the box, and be paranoid on your own. Be one of the few individuals which check the MD5 sums of apps, uses PGP for all sensitive emails, dosen't send enable passwords via AIM or nextel two way, and pushes their snmpv1(v3!) traffic over IPSEC tunnels just because it runs through a piece of fiber in 1 whilsire (shudder!!). An important subject which very few articles cover is your personal habits, be organized, document, and share security responsibility and paranoia with other admins in your organization; this is by far the largest hurdle and largest downfalls of many.
(please excuse any mispellings, gramar, limited details, and bad formatting)
The object wasn't to turn them into security wizzes in a day, but to give them a grounding in some of the more fundamental bits of the game so that they could go away and do sensible things with their new firewall, etc, etc.
I gave a suggested reading list for the keen ones. The list was as follows:
1) Mccarthy, Linda
"Network Security, Stories from the Trenches"
ISBN: 0138947597
For 'fear of god', and a general real-life example of the kind of wierd shit you're dealing with. (Mccarthy is also an excellent book to pass on to your boss when you're done with it. A *Very* usefull tool if you've been having trouble getting security budget - it will scare the bejesus out of him/her. This is not a particularly technical book, but it's very good for laying the groundwork, and getting your head around the security business. Teaches you to think outside the square too.
2) Stoll, Clifford
"Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage"
ISBN: 0743411463
A real world, entertaining, walk-through the process of tracking a bad guy around the world. A nice easy to read book - technologically outdated now, but still interesting from the point of view of forensics and legals. This is not a technical book at all, but your boss still won't understand this one. NOTE: Don't make the mistake of being impressed by this book and running out to buy Cliff's other books. The first is a masterpiece, the rest are the ramblings of a tired and cynical man - not worth, frankly, the paper they're printed on. The Cuckoo's Egg is a nice book - buy it when your brain is just completely full of technical stuff, and you need a nice light (but still on-topic) story to give your brain a break.
3) Cheswick, William/Bellovin, Steven
"Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition"
ISBN: 020163466X
A bible for network and unix security. A detailed run-down on packets, ports, bells, whistles and how it all works. This book spends a lot of time analising specific network services, and their weaknesses. One chapter on a real-life tracking a bad guy, and some discussion of honeypots and lures. If you only buy one book, buy this one.
4) Garfinkel, Simson et-al
"Practical Unix & Internet Security, 3rd Edition" (The Safe Book)
ISBN: 0596003234
A practical, real-world, HOWTO on implementation of sensible security practices for unix administrators in particular. This is one you keep on your desk at work (well, chained to your desk with all your other O'Rielly books!) for day to day use.
5) Hunt, Craig
"TCP/IP Network Administration (3rd Edition)" (The Crab Book)
ISBN: 0596002971
A definitive bible on TCP/IP and how it works. All the guts from a techo (but not a programmer) point of view. This one doesn't spend much time on security per-se, but it is the book for TCP/IP.
The Sixth book in the pentology, for extra keen readers is The Cricket Book...
6) Liu, Cricket/Albitz, Paul
"DNS and BIND, Fourth Edition"
ISBN: 0596001584
Because, if you're working with the Internet, you're gonna be working with DNS, and if your DNS is broken (or you don't have the skills to tell that your DNS is broken) then you're screwed! You haven't arrived until you have a GOOD understanding of DNS, what it is, and how it works. After reading this one, go back and re-read Cheswick & Bellovin's discussion on securing DNS, and giving different answers to different people depending on who they are.
I find your ideas intriguing and I wish to subscribe to your newsletter.
The object wasn't to turn them into security wizzes in a day, but to give them a grounding in some of the more fundamental bits of the game so that they could go away and do sensible things with their new firewall, etc, etc.
I gave a suggested reading list for the keen ones. The list was as follows:
1) Mccarthy, Linda
"Network Security, Stories from the Trenches"
ISBN: 0138947597
For 'fear of god', and a general real-life example of the kind of wierd shit you're dealing with. (Mccarthy is also an excellent book to pass on to your boss when you're done with it. A *Very* usefull tool if you've been having trouble getting security budget - it will scare the bejesus out of him/her. This is not a particularly technical book, but it's very good for laying the groundwork, and getting your head around the security business. Teaches you to think outside the square too.
Perhaps the most important thing about the Mccarthy book is that it almost completely ignores technical subjects, and concentrates on the human and social engineering sides of security. Blocking ports and changing passwords every month is all well and good, but if someone can sweet talk your receptionist into handing over her password, then...
2) Stoll, Clifford
"Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage"
ISBN: 0743411463
A real world, entertaining, walk-through the process of tracking a bad guy around the world. A nice easy to read book - technologically outdated now, but still interesting from the point of view of forensics and legals. This is not a technical book at all, but your boss still won't understand this one. NOTE: Don't make the mistake of being impressed by this book and running out to buy Cliff's other books. The first is a masterpiece, the rest are the ramblings of a tired and cynical man - not worth, frankly, the paper they're printed on. The Cuckoo's Egg is a nice book - buy it when your brain is just completely full of technical stuff, and you need a nice light (but still on-topic) story to give your brain a break.
3) Cheswick, William/Bellovin, Steven
"Firewalls and Internet Security: Repelling the Wily Hacker, Second Edition"
ISBN: 020163466X
A bible for network and unix security. A detailed run-down on packets, ports, bells, whistles and how it all works. This book spends a lot of time analising specific network services, and their weaknesses. One chapter on a real-life tracking a bad guy, and some discussion of honeypots and lures. If you only buy one book, buy this one.
4) Garfinkel, Simson et-al
"Practical Unix & Internet Security, 3rd Edition" (The Safe Book)
ISBN: 0596003234
A practical, real-world, HOWTO on implementation of sensible security practices for unix administrators in particular. This is one you keep on your desk at work (well, chained to your desk with all your other O'Rielly books!) for day to day use.
5) Hunt, Craig
"TCP/IP Network Administration (3rd Edition)" (The Crab Book)
ISBN: 0596002971
A definitive bible on TCP/IP and how it works. All the guts from a techo (but not a programmer) point of view. This one doesn't spend much time on security per-se, but it is the book for TCP/IP.
The Sixth book in the pentology, for extra keen readers is The Cricket Book...
6) Liu, Cricket/Albitz, Paul
"DNS and BIND, Fourth Edition"
ISBN: 0596001584
Because, if
I find your ideas intriguing and I wish to subscribe to your newsletter.
If you don't know how to check your POP3 e-mail and retrieve a web page with nothing more than a telnet client
That's nothing! Back in my day we had to use SSH with nothing but a phone line and a toothpick, and we were lucky! Some people didn't get the toothpick.
By reading this comment, you immediately waive any and all rights regarding it.
I am a security officer with an ISP and telecom company, here's how I got there: Real-life work experience.
Unless you are already a proficient hacker and have published a couple of advisories, don't try to get started in network security. Start as a sysadmin. Get some experience on how the system works.
When you can run a system (and believe me, if you want to tell admins what to do or not to do, you must be on their level or they'll laugh you out the door), start to concentrate on the security aspects. Dig deeper into the host-based firewall, install an IDS or tripwire, that stuff.
Move up, step by step. There are already way too many people with a solid half-true partial knowledge of the field in the security business. Lay a solid foundation. If you don't know how to operate a server or a network, you have no business securing it.
Assorted stuff I do sometimes: Lemuria.org
I'm also a moderator over at security-forums and we get alot of newbies trying to learn everything overnight! They don't want to take the time and effort to read, read, and read some more, they don't realize that it has taken most of us 10+ years to know everything we know, and still have to learn new things everyday.
I do also believe you should have a test lab enviroment to test and hone your skills. Most security professionals have test labs to test new exploits or try new security prevention technqiues, because in infosec its always cutting edge area which you have to make an everyday effort to keep up with or you'll fall behind quickly.
Read before you do, so when you do, you know what you are doing.
Founder of Securityflaw Creator of
This cannot be overstated.
If you are new to the company and the field, find someone who has been doing this job for a while and pick their brain whenever you can. Then go out to the net and find what information you can. I have found that a mentor can really give you a step up in the game. Talk to people online who have been hacked, find out what they did wrong, read security vulnerability reports, subscribe to CERT and BugTraq and any other security list you can find, then realize that you still don't know enough.
This game is so complex, realize that you can't reasonably expect yourself to learn everything in a week and be an expert. It has been mentioned that the only real teacher is experience, this is so true that it should be mentioned in every book you buy on this subject.
A better way to start is to get a job as a sysadmin for some company and go to town with a test box. Install OpenBSD, about 10 flavors of linux and (I can't believe I'm suggesting this! *dons flame suit*) Windows. For better or worse Windows is here to stay and most companies are using it so you better learn it or you'll be limiting your employment opportunities. (But study Linux more *peeks out of helmet*).
Of course You should read as much as possible about security concepts, cryptography ... (i recommend strongly to consumt some theoretical background - it clear things up a lot). But the most important step is: GET FAMILIAR with protocols & packets.
... and so on. There's a whole world, waiting for You to discover it ;-) /graf0z.
So start whenever You have a reason or not tcpdump or [t]ethereal and watch the matrix. You will get more and more intuition about what's happening. Let ethereal decompose headers. Use fragroute to create fragmented traffic. Use telnet as a browser and mailreader (HTTP, POP3 and SMTP are quite simple, IMAP is less simple but still possible). Read original RFC about the protocols.
Ok, in the begin it will be hard and You won't understand much. But i promise: if You stay the course, You will understand networking _much_ better. This is THE precondition to understand network security.
Then play with ettercap, nessus, snort (write your own snort-patterns), try out some exploits (breaking into your own services), get familar with a good packetfilter like iptables/netfilter or pf. Learn how connection tracking and NAT works.
Implement one of those scripting-MSIE-exploits and put it on your webserver. Visit http://packetstorm.linuxsecurity.com/ and read phrack magazine http://www.phrack.org. Play with jails of all kinds (bsd-jails, chroot, se-linux) or MAC/ACL-systems to secure services.
And Snort is better for this. You capture and analyze traffic as it actually exists on the wire - Layer 2 and up.
"Flyin' in just a sweet place,
Never been known to fail..."