lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040309165159.GB17218@hal9000.halplant.com> From: A.J.Caines at halplant.com (Andrew J Caines) Subject: Re: Where to start Aschwin, In case it wasn't obvious, you are in essence asking how to become experienced. The answer is, as always, experience. > Does a good security-officer have to know everything about every hole? Of course not. A good security professional (or amateur) will however know about the many types of vulnerabilities, exploits, attacks, defences and most importantly where to find the detailed information on specific threats and which ones are relevant. > I myself don't think so, but where do people start? If you're not working within the systems or network security field, then becoming involved with the community through its information sources (such as this list), combined with as much practical experience as your resources allow is probably the best way to get started. These days it's enough to operate a system with a connection to the Internet to enjoy a substantial amount of experience of real-world threats and (one hopes) how to defend against them. > If I see lists and forums about network-security it seems that everybody > knows a lot and has a huge reference base. Is this true? If someone is smarter or more knowledgeable than you, then it is normally impossible to tell _how much_ smarter or more knowledgeable they are. As you learn, you'll evolve a picture of the distribution of expertise. > I want to learn more about security stuff, but I can't find the real > basics to build upon anywhere. In my opinion, it's important to understand what "security" is before getting too caught up in the systems, tools and activities. For this I can't think of anything better than reading Bruce Schneier's "Secrets and Lies" (and his new book, "Beyond Fear"), along with his "Crypto-Gram" newsletter. [I don't get any kickbacks, but wouldn't say no if offered!] If there is one fault most prevalent in people working in the field, it's that they lack contextual understanding and focus too closely on the specifics of tools and methods; a typical case of not seeing woods for trees. This is an understandable condition, given the nature of the field, as I mention below. > When there are posts on lists they presume that everybody has a certain > knowledge level and are aware of best practices. But is this true? Of course, it is necessarily so. Everyone addresses their intended audience, however the actual audience will only approximately match the intended one. I'm sure almost none of us completely understand all the issues discussed on this list and a similar number will agree on which practices are "best". > Just because there are discussions, it seems that there is not one overall > and central way of keeping track of evolving issues. The field is changing and expanding so rapidly and has such ill-defined borders, it's impossible to establish and achieve broad consensus on any kind of central repository or authority. Even if such a thing could exist, it would not be desirable anyway. There have been and will continue to be some worthwhile efforts at centralising information, such as CERT[2], SANS[3], CVE[4], CIAC[5], etc. but their value changes over time. Experience in the field includes getting to know the value, as well as the location, of the many information sources. > How do people keep track easily with up to date best practices and not get > distracted by "old" advisory? By keeping a vigilant watch on what's going on outside your walls, as well as what goes on inside and passes through them. When you can, learn from others' mistakes before you have to learn from yours. See what other people do, but with a highly critical eye. Knowing what really counts as "Best Practice" is a bit like knowing perfect truth in that it's more a goal than an achievement. What's more, it's a moving goal. On of the trickiest things these days is distinguishing between valuable and accurate information and snake oil, especially since both can come from the same source. Consider the source as well as the information. In the spirit of vague generalisations and pontification, I'll close by reminding everyone that in the end it's not about the systems, the networks or even the data you protect, but the people who use it. Of course they also happen to be your biggest problem. "Security is not a dirty word, Blackadder. Crevice is a dirty word, but security isn't!" - General Sir Anthony Cecil Hogmanay Melchett, "Blackadder Goes Forth" [1] http://www.schneier.com/ [2] http://www.cert.org/ [3] http://www.sans.org/ [4] http://cve.mitre.org/ [5] http://www.ciac.org/ -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines@...plant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 |
Powered by blists - more mailing lists