| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed Nov 23 10:02:13 2005 From: barrie at reboot-robot.net (Barrie Dempster) Subject: Hacking Boot camps! On Tue, 2005-11-22 at 23:57 -0500, Valdis.Kletnieks@...edu wrote: > Keep in mind that 98% of systems are nailed by either automated worms or > people running canned stuff. Just because it's not "real hacking" doesn't > mean it doesn't actually work in practice. Quite right, the majority of security incidents dealt with by administrators (the guys that have a use for these courses) are the automated/canned/known attacks, so for people in that position an understanding of these attacks is extremely important for their own network defense. These courses usually market themselves to the guy looking to understand how systems are compromised. They are most useful for pen-testers that rely on vulnerability scanners and the sysadmin looking after his network. For the guys writing the exploit code and figuring out to work around things like ProPolice and DEP these courses won't help - no matter how in depth they are, because figuring these sort of details out doesn't require any knowledge you can be taught in a classroom, it requires dedication and in most cases addiction to the task. There definitely is a market and a value in these courses as they raise the general security awareness of network administrators. A common question among guys working in these sort of roles is "How do I get to do that cool security stuff", the sad thing is the fact that they don't already know the answer means they probably will never be any good, as the most important part of it is ingenuity and initiative as well as the dedication/addiction mentioned above. The common mantra used within this sort of training is "think like an attacker". My opinion is if you have to be taught that, you can never think like an attacker, because the attacker doesn't have to focus his thoughts he is always, automatically, looking for a way around/over/under/through. The guy trying to think like an attacker is focusing on his adversary when the real focus should be his systems, because that's where the attackers focus is. -- With Regards.. Barrie Dempster (zeedo) - Fortiter et Strenue "He who hingeth aboot, geteth hee-haw" Victor - Still Game blog: http://reboot-robot.net sites: http://www.bsrf.org.uk - http://www.security-forums.com ca: https://www.cacert.org/index.php?id=3 -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 1859 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051123/f3aa56ea/smime.bin
Powered by blists - more mailing lists