Perhaps I am being both naive and overly ambitious in my first post but I have a huge interest in learning about network and system security and am at a loss as to where to begin. I realize that stack exchange sites are not too keen on having large broad sweeping questions with potentially opinionated answers, but I thought it would be a great idea to ask a multitude of basic security type questions and perhaps it could be compiled into a sticky or faq, to help out newbies and prevent similar questions from being asked ad nauseam. If something similar exists, then perhaps I could be guided to such resource(s) before this topic is closed.
Before I begin with my questions I should make clearer exactly why I am asking them in the first place. I am just starting to delve deeper into my understanding of Unix and Win based systems. The more I delve, the more I realize how important security is, and how little I actually understand the topic. I have attempted to read into the subject by pouring through several security handbooks, technical manuals, and forums and I inevitably run into the same issues and confusion.
A. Info is diffused among 1000s of books, sites, and forums.
B. Info is rife with technical jargon that needlessly complicates comprehension.
C. Often, examples are given as solutions but are not accompanied by explanations as to why commands are run and exactly what one should be looking for when doing so.
I am by no means an IT expert but I would like to either compile or discover a resource that allows basic skilled users to create a secure system/network to deter hackers.
Once again I realize this may be too ambitious for one post but hopefully you won't fault me for trying. As such, here are my questions. Please specify where applicable if your info pertains to Unix or Win based systems.
Question 1- IP Address, Subnet Masks, DNS Servers, Proxies, MAC addresses, ports, TCP/IP, UDP and perhaps more I am missing. Is there one single resource that effectively explains how these often very similar looking numbers and systems relate to one another? I especially get mind-twisted by these systems because for example with IP addresses, I never know when a reference is talking about my router IP, host IP, individual computer IP, etc. and when you throw ports into the mix it becomes even more of a number tangle.
Question 2- How would you set up and arrange the hardware of your network? Would you use a hardware firewall? If so where would the hardware firewall be located in the network? Is there any other hardware that could be added to the network to improve security. What settings should be used at the hardware level to minimize outside access?
Question 3- What are some good general settings for firewalls to mitigate outside access? Does MAC address filtering do anything useful or is it too easy to work around it? How do you balance allowing local users to have maximal access while mitigating security holes?
Question 4- I often see recommendations to close ports. Does this in reality make anything more secure or will hackers merely use the few ports you must have open for basic usage? Also does the port number effect how and what information can be sent through it or are they merely conventions ex. port 80 being http only or can malicious people send other types of data through it?
Question 5- What commands should [Unix] or [Win] users run on a [daily], [weekly], [monthly] basis to check for malicious processes? Please explain these commands in depth and what a user would be scanning for in particular. What log files are useful to monitor?
Question 6- What routine(s) do you use in your daily workflow (especially for those employed as system or security administrators) to mitigate risk and actively check for weak links? Do you use a suite of software, or manually check logs? Do you rely on scripts and if so, when do you make the decision to make a slightly deeper manual search? What forms of authorization do you use? What do you feel are the inherent strengths and weaknesses of such authorization system(s)?
Question 7- Are you fearful that 3rd party softwares could potentially add backdoor security breaches to your system? If so, how do you address this issue if the source code is not open source?
If you can think of any other pertinent advice feel free to add.