Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been searching frantically for a college that has a good information security program. One of the ones I came across is Wilmington Universities Computer and Network Security program. I got a little exited when I saw it. The college is very close, it's cheap, and it has the program I want. I then went to an open house event that they were hosting. I talked to once of the teachers (she teaches in the technology department but does more web development) and to say the least my dreams were a little crushed. When I asked her about the program further she told me that they only had one programming class and that was in python. This killed me for two reasons. First I enjoy the programming side of security. And second because it was python.

What should someone look for in a higher education plan when trying to go into IT security. I understand that it is a broad field and there are differences between each type but what do you think?

Since I know you guys go in depth with your answers can you lay out a list of different things you should be looking for when searching for each individual section? I understand it is a lot of work but this should be able to help people for a long time.

share|improve this question
2  
Just out of interest really - is there any reason for python being a problem? Usually, being able to prototype quickly is really desirable and scripting languages are good for this (Rory Alsop said so!). Metasploit for example is written in Ruby which is like Python, but for cool kids. I wouldn't dismiss Python or any other scripting language as necessarily a "bad one" - you certainly can't beat them for speed of use. –  user2213 May 12 '13 at 15:08
4  
Also, I don't know if this question is necessarily suited to the site proper - see the don't ask FAQ section. However, if it doesn't work out there is always The DMZ where you can chat with other site members and ask their experiences, which might be more what you need. –  user2213 May 12 '13 at 15:08
    
@AntonyVennard Maybe I didn't word it right. It's not that Python is bad it's that Python good for prototyping and fast good things but it's speed of use. Quality over speed in my mind (most likely not a bosses) is better. I'd defiantly use python for a hotfix but I think going back and doing it right would be best. –  Griffin Nowak May 12 '13 at 15:18
    
@AntonyVennard Yes I was wondering that myself but I didn't want quick answers I wanted a good break down of what you should find where. Plus if it's done in the DMZ it's doubtful that anyone else wo is looking for it will find it. –  Griffin Nowak May 12 '13 at 15:21
    
@Griffin Research! U may want to read the book "Violent Python: A cookbook for ..." - TJ O'Conner (MS in CS from NC State, MS in IS from SANS, BS in CS from Mil Acad). The first sentence of this book reads "Python is a hackers language". You will need a broad understanding of many CS topics to be successful at InfoSec. You shouldn't be looking at what this school DOESNT offer, instead looking at what they DO offer. As long as you learn CS it doesn't matter if its taught in C++, Java, Python, or Scheme. You must admit that YOU don't know whats best for you, thats what youre going to school for! –  Charles Addis Jun 18 '13 at 17:53
add comment

3 Answers

up vote 6 down vote accepted

I have to say, reading the program materials, I'm not surprised.

As you say, the IT security field is very broad - and programming is only a very thin slice of it. If you love programming, and are looking for it to be the center point of your education and your work, then I'd offer the idea that what you're really looking for are courses in Software Security - and I have yet to see many (or any) cirriculums using this as a center point.

Things to think about when looking for advanced education and working in IT Security...

What do you want the education to do for you?

IT security is still such a new field that it will be a long time before anyone really knows what a "classic" IT security professional is capable of. It will be even longer until there are jobs that require an IT Security degree as a baseline. I'd bet money that over the next 10 years, the majority of IT Security professionals are NOT people who have degrees or advanced degrees in anything bearing the title "security" - the field is still too new and too diverse.

So - the goal returns to being - what do you want from the degree? An IT security degree as the programs I've seen are currently designed will help get you in touch with some of the current best practices and the business tradeoffs in the industry. But if you want to be a technical whiz at any particular discipline (programming, networking, computer OSes, management) - then consider a program in that discipline.

What IS an IT security degree?

I expect this answer to be extremely dated in the next few years, but worth the attempt...

It's currently separating itself from any specific discipline which contributes to IT Security, in favor of creating an overall perspective that goes across these disciplines and lets students take a broad perspective to:

  • Identifying and mitigating risk
  • Making IT decisions that align security with business value
  • See the gaps in security that occur across disciplines
  • Align various experts from various disciplines to creating a secure solution that actually works.
  • Protect the company from a legal standpoint - knowing enough about the law and forensics to make sure that the company operates legally, and that should prosecution of an attacker be necessary, the data provided by techology can be used as evidence

So in any program these days, I'd expect to see a minimal bit of:

  • Programming - both hacking and secure software development
  • Operating system security
  • Network Security
  • Web app security (yes, some programming but also the application layer network stuff)
  • Physical security
  • Social engineering/human policy

With that diverse of a topic set, I'm not surpised that programming (or any single discipline) is only taking a small part of the cirriculum.

The hiring market today

I leap to this mostly because the #1 reason people pursue education is to get a job. The key to getting a job is to have the skills that people will pay you for.

Since there really is no predent yet, there's not a single job that recruits exclusively for this type of degree. Key areas that are looking for heavy security knowledge include:

  • Pen tests - probably the most "glamorous" field - the one everyone thinks of - testing a secure system for cracks and helping to provide input to fixing weaknesses - takes some programming, but as important is a detailed knowledge about what you are trying to break into - products, protocols and human weaknesses.
  • Audit - reviewing (not pen testing) systems for compliance with security regulations.
  • Operations - running and making day to day decisions about systems with a high degree of security risk - more likely to require superior debugging skills and judgement than programming knowledge.
  • IT security implementation - upgrading, and creating new components for secure systems
  • Risk management - decisions and strategy about the risk of the current state of the system and the risk of making suggested changes to it.

Only a fraction of these jobs currently require hacking expertise or serious programming skills. Most require some depth of knowledge about key security controls and an ability to learn and review security controls in light of the capabilities of hackers.

Evolution in progress

Security related cirriculums are very much in transition. Professional groups I work with now are actively engaged in revising and refining these programs - they are very new and still very much in transition. The trick I see as a hiring manager is that there's a rock and a hard place right now - the key jobs in security that are very hard to fill take serious technical expertise, great communication skills, and good judgement. The way these roles are filled right now is with people who are usually 10+ years into their careers - they've gained technical depth in key areas through previous work, they've survived some serious challenges that gave them good judgement and they've spent enough time communicating to have gotten better at it.

Ideally, those of us in the industry will find ways to leverage new college grads to fill in some of this work and leverage our experienced folks as guides and mentors - like other technology disciplines. The trick is - there's no one sized fits all program yet. Risk, cost, the nexus of technology and people - that's more or less transferable job to job. But the details that each roll needs has typically been so company specific that it's hard to fill.

Computer & Network Security - specifically

This particular course is branded as Computer and Network Security, specifically, which is - IMO - rather enticing. I've seen IT Security, and CyberSecurity and the open ended nature of these titles always makes me worry. At least computer & network security suggests a program centering around ... well... computers and networks!

Taking the program in smaller detail, and going back to my main points:

  • Identifying and mitigating risk - hard to tell in this cirriculum - there's a principles and practices - but I'd have to read a description to see if they agree with me on risk mitigation as a "best practice".
  • Making IT decisions that align security with business value - maybe - there's some intro economics here, but one wonders how close to IT it really gets...
  • See the gaps in security that occur across disciplines - hopefully - but this is really hard to teach
  • Align various experts from various disciplines - yep - the various SEC courses are doing a decent job - some OS (LINUX and Windows), some networking (there's a 101 telecom sounding course, and also one on networking security controls)
  • Protect the company from a legal standpoint - nice - the CRJ and LES courses are pretty enticing - assuming the course is of high quality, the philosophy course on ethis is nice, too.

If I were interviewing a candidate and saw this degree, the first step would be to do what I'm doing now. I'd also:

  • scope out other graduates - what fields are they working in? This looks forensic heavy - are candidates working primarily law enforcement?

  • Interview for content - certainly the basics look good - can the candidate really configure the security controls I'll need him to configure? How hands on was any of this work (not programming - staging, fixing and installing computer systems and network gear)

  • look for project work focusing on interdisciplinary collaboration - if you can't work with people who think differently, you won't work in most security jobs.

As a graduate - I'd have one more question -- how many of your professors are working in the field? The field is growing and changing rapidly - if your profs aren't getting in and doing hands on work, then you're getting a theory based education and you may have to unlearn much of what you've learned when you get to a job. A real key in this area is having the opportunity to work with people who have knowledge of the industry and whose theories have been proven in practice.

share|improve this answer
add comment

Find the one that actually teaches you how to hack. Many courses focus on crypto and "security policy" topics instead of giving people hands-on experience. Breaking into things is much more paid and much more sought after in the current environment.

This is what one uni does in Australia - http://www.smh.com.au/it-pro/security-it/how-unsw-creates-the-worlds-best-hackers-20130510-2jdbt.html

Dan Guido at NYU-Poly teaches a similar course http://www.poly.edu/user/dguido.

share|improve this answer
add comment

I'm not sure if I can tell you what school has a good information security program, but I think what you should probably look into is good computer science schools. I believe that in order to be a 'hacker' you have to be able to think like a hacker. Thinking like a hacker is easiest once you have learned the mechanics of the technology employed by your target. Learning computer science, some schools have programs that are geared towards networks and network security.

Also, I don't understand your frustration with learning Python. You could probably learn Python at home. Python is a very powerful programming language, and it's purpose is to be a fun language that is easy to learn. That is why it is called Python, after Monty Python. In the Python documentation there are Monty Python references used instead of traditional pseudo-code variables like foo, bar, and baz. Anyway, Python is used quite a bit in the pen testing world so maybe you might want to reconsider learning it. Python is so powerful, and provides such fast development times that many exploits are written in Python.

Anyway, some good computer science schools for you to check out would be:

  1. UC Berkeley
  2. University of Texas, Austin
  3. Carnegie Melon
  4. University of Washington
  5. California Institute of Technology
  6. Georgia Institute of Technology
  7. University of Wisconsin, Madison
  8. University of North Carolina, Chapel Hill

I hope this doesn't come off wrong, but this is one of those things where your either good at it or your not. It's good to be able to read and write a variety of programming languages for all types of exploits, such as C, Python, Ruby, SQL, JavaScript, HTML, C++, PHP, .NET/C#/F#, Java, Assembler, etc, etc. For instance if you are pen testing web apps you should definitely learn web languages. Likewise if you are pen testing Networks you should learn C, Java, Common Lisp AND/OR Scheme AND/OR Clojure, Python, and C++.

You'll of course want to learn quite a bit about networking itself. Learn the OSI model, and really learn as much as you can. You'll want to learn how to create packets and inject them. You'll also want to learn how to sniff packets using popular tools like Wireshark, pcap, etc. You'll definitely want to learn Ruby and learn the Metasploit framework. And you'll most certainly want to learn how to identify and be able to read base 2, base 8, base 16, etc (binary, octal, hexadecimal..).

There is quite a bit more that I am not telling you, of course you will need to learn about exploits such as buffer overflows, heap sprays, SQL injections, etc and one will want to have an understanding of shell code and assembly. You definitely need to lurk security advisory boards and chat up other info sec professionals. Go lurk in some IRC rooms with a honeypot server set up somewhere, perhaps at your house and preferably not on a public network like a dorm, and go into a Anonymous channel, or some other channel like a 2600 channel and bait them with your honey pot while you're watching live logs of all the exploits they try to pull on your machine. They may be using public exploits against your system looking to see if its patched, but if they have a 0day you now have an unpatched exploit to add to your arsenal, possibly with an un-notified vendor.

You will most certainly need to master the art of social engineering. You will want to practice this every chance you get. At first it may feel a little strange, perhaps a little wrong to be lying and manipulating people. Soon you will understand that techniques that you use to exploit networks have some mirrored applications in social engineering.

Oh and if your into hardware hacking you'll probably want to incorporate some engineering into your curriculum.

This may sound like quite a big order. It doesn't happen all at once. Obviously there is still a lot of stuff out there that I didn't even mention that is relevant to a good info sec education. There are many info sec professionals who do not have college degrees but who are leaders in the field. There are also those who graduates from schools like MIT and Cornell. Not all people are meant for an info sec career, some people should look to procure jobs in other IT/CS fields. That being said, those that do procure careers as info sec professionals typically have a very broad knowledge of computer science and are not just exclusively knowledgeable about information security and their definitely not script kiddies either.

share|improve this answer
    
"Also, I don't understand your frustration with learning Python. You could probably learn Python at home. " Exactly. So why should I pay someone to teach it to me. –  Griffin Nowak Jun 18 '13 at 6:10
    
@Griffin because at home you may pick up on bad programming/computer science skills. You must understand that the language is not important - what you are going to school for is to learn computer science. You would be surprised what a powerful language Python is, I think you are just holding a grudge against something you don't understand. Learning Python as a first language is perfect: you are learning a language that provides the same low-level features as languages like C and C++ with the difference being that Python code is portable. It will make learning CS easier than, strong typed lang –  Charles Addis Jun 18 '13 at 17:01
    
@Griffin if you think you are going to learn one language and master that during your 4 years at school, well, I hate to be the one to say it but... you will be behind your peers. Most of your peers, even at schools that teach Java and C++, will be learning Python in their free time because it allows you to write more powerful code/scripts with less code than its strong-typed comrades, resulting in easy 2 understand programs and maintainable code. In order to be a successful CS student you must remain open-minded and teachable, and it's quite evident that you think you know it all so why go? –  Charles Addis Jun 18 '13 at 17:05
    
@Griffin as a student interested in learning Information Security you would be doing yourself a great disservice if you do not learn Python (which I believe should be learned before Ruby). You are very fortunate to have found a school that teaches Computer Science with Python because it will allow you to focus more on problem analysis/design instead of focusing on debugging. Remember, you are going 2 school 2 be taught, not to teach. No language is perfect for every job. Python is a great language for writing security tools and exploits. You can learn any lang from home, you learn CS @ Unvrsty –  Charles Addis Jun 18 '13 at 17:12
    
I do not know it all at all. In fact if you look at my other questions it is very evident. Also you confused me you said "You must understand that the language is not important - what you are going to school for is to learn computer science." . Based on what I've experienced at a basic level languages are very similar. I'm also not only learning 1 language. The thing is I don't face a grudge against it as you seem so strongly to think. My big problem with it is I don't want to go to a university and learn 1 language. Especially one that isn't extremely complicated. –  Griffin Nowak Jun 20 '13 at 1:22
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.