Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm currently studying Computer Science, where we're teached Java programming. I want to get into the IT-security field, but it seems to me that Ruby and Python are more relevant for that, so I have a hard time motivating myself to learn Java.

But do Java have a place in modern IT-Security compared to say, Ruby or Python?

share|improve this question
6  
Java has a place in security in all the wrong ways. –  Steve Jan 19 at 18:23
    
I think you should go into the "jack of all trades" path here. But just having some grasp of "how to make a GUI in Visual Basic to trace the criminal's IP" (lol) doesn't cut it :P So in other words, there's a long road ahead of you. –  Camilo Martin Jan 20 at 0:49

3 Answers 3

up vote 19 down vote accepted

Programming is relevant to IT-Security; it may be subtitled as "yeah, I kinda grasp the concepts of what I am blabbing about". You cannot be a decent practitioner of IT security if you cannot imagine what occurs in a computer beyond something like "then magic occurs". This necessarily implies some basic skills at development.

The exact programming language does not matter much. In fact, if the programming language matters to you, then you don't know enough programming yet. If you want to "get into the IT-security field" then you must reach the point where your question feels ridiculous, as in "how could I have been such a twerp to ask such a silly question ?". Meanwhile, go learn how to do basic programming in at least two or three different languages (Java may be one of them); this is the path to enlightenment.

share|improve this answer
1  
+1 for the honesty at the end. –  Camilo Martin Jan 20 at 0:46
    
Could you clarify on "if the programming language matters to you, then you don't know enough programming yet"? –  Anh Jan 20 at 2:20
3  
@Anh: If you know one language, or are trying to only learn one language, you're naturally going to tend to look at every problem from that language's POV, and possibly try to shove it into that language's little box. If you're solely learning Java, for example, the concept of a buffer overrun might be too abstract to even make sense to you. You need to know something about at least a couple of different languages, including C and/or an assembly language, so you can step back and look at things from a more language-agnostic, more computer-centric POV. –  cHao Jan 20 at 3:34
1  
Not just that, but the fact that most security flaw types are agnostic to the underlying programming language. You could equally have buffer overflows in C, C++, and Delphi. You might have poor password storage in any application, regardless of the languages and technologies involved. Even SQL injection is not limited to a particular dialect of SQL. –  Polynomial Jan 20 at 12:09

If you want to get into technical IT Security you should get a solid basis in all different subjects, programing, networking and system administration. Motivation to learn, often rather boring and complex subjects, is important. Only by understanding how something works, you can find out if it works securely or not.

Python and Ruby are as relevant as Java,C,LISP or even COBOL. Every single programing language is just a tool used to achieve your goal: perform a security assessment in an automated way. Python and Ruby are often used to write scripts, but this is not only relevant to IT Security, but just in general for the IT community.

Java is used less than Python and Ruby to create scripts, but it's definetely relevant to IT Security when it comes to, for instance, client side exploitation. You must also remember that these days a lot of application are being written in Java. Part of IT Security is to assess existing applications by looking at its source code. Having a solid basis in Java is imperative if you want to assess Java applications.

share|improve this answer

Java is in fact extremely relevant to information security because the Java Browser Plugin is one of the most prominent ways of malware distribution. See e.g. this recent article:

The Cisco 2014 Annual Security Report found that Java represented 91 percent of all Indicators of Compromise (IOCs) in 2013.

If you plan to work seriously in security, you're most likely going to be faced with a lot of malicious or vulnerable Java. This makes a basic knowledge of Java important, but more important yet is a solid understanding of programming and computing principles: you must understand what actually happens in a computer on a systems-level. You should learn several programming languages and become a competent programmer --- it goes hand-in-hand with working in IT security.

Moreover, to aid your understanding, you should not only use high-level languages like Java or Ruby or Python, but you should learn languages closer to the machine level (at least C, understanding assembler would also be good if you want to fight malware) if you really want to do security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.