Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a university lecturer and a web and desktop software developer. For many reasons I want to learn software security to change my field in the long run. It's been a few days that I've started studying tcp/ip as my first step in this still self-learning process.

I thought it's better to share my efforts with the community to get as much as I can from experienced experts. I appreciate any guideline and etc which you will share.

Do you think I'm on the right track? Do you think it's a must to learn tcp/ip very deep?

share|improve this question
    
This is not a desirable attitude to have when perusing such a complex research topic. –  Rook Nov 30 '12 at 17:55
    
I'm not sure that I got you. Could you please illustrate it a more? I'm not lazy but I want to know my priorities. –  Amirh Nov 30 '12 at 19:39
    
I don't think it was your intent, but "have to" implies your unwillingly or not happy to learn it. Perhaps the question could be rephrased to "..do I need to learn TCP/IP" or "..should I learn..". –  Andy Pryor Nov 30 '12 at 19:46
    
Oh yes, thanks Andy. –  Amirh Nov 30 '12 at 19:53
    
As a curious onlooker, the following quote gave me some interest: "...I want to learn software security to change my field..." Does that mean change the direction or focus the field as a whole is heading in, or simply a change in a more personal specialization? –  JustinC Nov 30 '12 at 20:37
show 2 more comments

6 Answers 6

up vote 39 down vote accepted

IT in general, IT security in particular, is an area where you should always learn. When you do not want to learn any further, then it is time to retire. Therefore, you should already be eager to learn TCP/IP, and your question should be: "do I learn TCP/IP first, or is there something more urgent ?"

Knowing the internals of TCP/IP is an invaluable tool for understanding what is going on; it is very enlightening. I warmly recommend that you study it. Similarly, I recommend some knowledge of assembly, possibly electronics. Grasping the internal structure of protocols and languages and architectures allows you to keep track of the ever changing field of IT security with much less effort than simply looking at the surface of things.

(For instance, in my everyday work, knowing how SSL works turns out to be extremely useful, on a daily basis.)

share|improve this answer
    
Thanks for your answer. What I got is that you mean I need to investigate the implementation of the protocol too:-) –  Amirh Nov 30 '12 at 13:24
1  
@Amirh What Thomas means that IT Security is a very wide field. IT Security experts are usually expected to be experts in some specific IT domain. In this field, more knowledge is never harmful. –  Terry Chia Nov 30 '12 at 13:54
    
@Terry Chia, actually I think I could start with learning ethical hacking but based on my experience I thought it's better to build a solid network foundation first. –  Amirh Nov 30 '12 at 14:01
    
Wish I could +1 this a hundred times. If your career is in technology, then a reluctance to learn is a red flag that you need to retire or change your career. –  Phil Nov 30 '12 at 14:39
    
I'd also chime in that even physical security is worth studying as well. IT Security has areas outside even the technical world since all the network protection in the world doesn't matter if they can waltz in to your data center and walk off with your hard drives. (And yes, if encrypted at rest, it wouldn't be the end of the world, but still would not be good.) –  AJ Henderson Nov 30 '12 at 14:39
add comment

Very deep? Assuming that means reading and understanding the entire RFC then no. What you need to understand in IT security is what happens to data end to end from when it is accessed by an application, to being transmitted over a network or the internet, to when it is re-assembled and used by an application on another system wherever that is in the world.

Understanding TCP/IP is a good thing, you also need to understand the context it operates in and its interactions with OSes and applications for it to be useful in a security context.

share|improve this answer
    
Thanks for your answer. As I said in my last comment to Thomas, what I got is that you mean I need to investigate the implementation of the protocol too:-) –  Amirh Nov 30 '12 at 13:25
    
As a software developer with an interest in IT security understanding the implementation would be a good thing. So many developers have no idea about how network transport works, so they don't think about how to streamline their implementations or make them secure. –  GdD Nov 30 '12 at 13:27
add comment

TCP/IP is a suite of protocols and a broad subject to learn but it is invaluable to know at least common application layer protocols (DHCP, DHCPv6, DNS, FTP, HTTP, IMAP, LDAP, NTP, POP, RPC, SMTP, SNMP, SOCKS, SSH, Telnet, TLS/SSL), at transport layer at least TCP and UDP, routing protocol for example RIP, Internet layer both IPv4 and IPv6, ICMP, ICMPv6, link layer tunnels for example L2TP.

The better you understand the internet protocols the more informed are your IT security decisions.

share|improve this answer
add comment

Basically I think there is a big distinction between knowing a protocol or set of protocols and meet one or more processes set as secure protocols, also because security itself may have several aspects and various depths, I not mean theory software but I would advise a good way to start with TCP/IP. Affirming a loud YES! is a splendid choice.

Therefore my main advice, as other users have advised to you; TCP/IP is a mainstay of digital communication and is very important, whatever your specialty, electronics or computer.

Now going into the details, since the ideal is to start where you can interact directly with the hardware, without any OS involved, luckily in the last 10 years, manufacturers of microcontrollers and microprocessors been made available to users' in the network, TCP/IP stacks shallow, easy to understand and implement, also they have pushed low-cost hardware to the disposal of users allowing many users trying a hardware implementation.

One of the most widespread is uIP (Totally free) and one of the most implemented by open hardware projects is the Microchip TCP/IP Stack (exclusive Microchip chips).

http://en.wikipedia.org/wiki/UIP_(micro_IP)

http://www.microchip.com/stellent/idcplg?IdcService=SS_GET_PAGE&nodeId=2505&param=en535724

I firmly believe that you can not be a specialist in something without knowing or being able to debug the source code and not knowing exactly how the hardware and that hardware allows a certain process, be it a diffusion mechanism or security mechanism.

It is also true that know in depth the hardware does not make you a security professional. But knowledge of the hardware details and the flow of the low-level software, are essential if you need solve real problems.

And finally I would like to advise a book, which I personally think is one of the best college texts to get started with the TCP/IP protocols

Data Communications and Networking by Behrouz A. Forouzan

share|improve this answer
1  
Thanks for your cool answer. Btw the author you mentioned is my countryman :-) –  Amirh Dec 1 '12 at 16:45
add comment

Learning TCP/IP very deep is a matter of perspective. How deep are we talking about here ? Deep enough to get you into trouble or deep as in dissecting data packets and analyzing level at the switches or routers ? First one, i.e., "enough to get into trouble" is easy. Just find few relevant websites and start reading. And if you can get your hands on a set of firewalls and routers, start messing with them. In no time, I can guarantee you, you will feel you can move the earth with your knowledge. And you actually can, albeit, in a negative way. I am a UNIX guy and systems administration provides my livelihood for the past 20+ years. I have worked through the thick and thin of the field. I have worked with good network people as well as the "worst". And at the beginning everybody seemed like they knew what they were talking about. After a few live events, I understood who was a security expert and who was just faking it.

If you are interested in security, you most probably heard the term, the most secure computer is the one which has no connections to any network. And when I say network, with the exception of few monolithic mainframes communicating to each other in some old (and now esoteric) protocol, likes of SNA, NetBEUI etc, everything is handled by TCP/IP. So security without knowing TCP/IP is nothing more than glorified virus cleaner in my opinion. So, if your heart is in the field of information security, you will need to know TCP/IP really well. And for that, I strongly suggest, starting from a basic network administrator curriculum (which I believe is provided by most any community college with a computing lab) and then build upon it. If you want to be really credible, you will need to step up to the plate and get a CCIE certification, followed by CISSP (Certified Information Systems Security Professional). And believe me, if you want to master this field , you're looking down the barrel for about 7-8 years, as you need to progress slowly in the field, while working in real life IT shops. Security is a moving target. You can not get to it, just by reading. You need practice and it'd better be in the real life, not in an isolated, learning lab.

share|improve this answer
add comment

When I first started in IT Security I had an okay but not expert knowledge of how server operating systems work with TCP/IP stacks, nor was I an expert in TCP/IP on the wire. I thought that it was unnecessary and that I wouldn't gain much from learning it.

Years later, now being intimately familiar with server TCP/IP stacks and TCP/IP on the wire, I can tell you that I understand what is going on exponentially better, and I am much faster at detecting anomalies and understanding new security threats. Yes, even at a software level.

However, when cutting into IT security my suggestion is you will typically not actually understand the security concerns unless you have the ability to configure the boxes as an admin. This means time in the trenches as an operations or admin employee.

So, while I would agree that a knowledge of TCP/IP is very important, you should also know that to actually grasp the entire IT Security field you must have advanced knowledge in a plethora of IT concentrations.

IT Security is a never-ending learning experience, similar to all IT concentrations. However, since Security is broad you need to be aware of the changes for ALL IT concentrations, which is what makes this field challenging (And why I went into it). You will deal with new technology and new threats constantly, and if you are unable to dedicate yourself to keeping up with the field, you will no longer be effective in your job.

That being said, I feel that it's a great place for academics such as yourself because the perpetual learning process is not new to you, and academics also are comfortable "deep diving" numerous technologies.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.