Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago.

What resources should I point him to? I'm hoping to find things that will go at a decent pace for someone of his caliber.

To scope this a bit, I'm mostly interested in (1) reading and analyzing logfiles (2) host level security common to most distributions of Linux

share|improve this question
    
This guys is both an MCSE (sysadmin) AND an MCSD? and you're gonna waste his time with reading logfiles? –  AviD Nov 23 '10 at 21:37
    
not a waste of time if you mix the skills together; and sell it at www.eventvwr.com :) –  makerofthings7 Nov 23 '10 at 21:45
    
I think the question is not right. To be honest the MCSE/MCSD bit is almost irrelevant. What the question should be is "What do you need to learn to be proficient regarding *nix security" as aside from the (very basic) basics they are entirely different beasts. [edited as I pressed Enter to soon :-)] Log file reading isn't really a *nix security skill - is practical for Ops teams, sure. For host level security you could even look at the basic info on Ubuntu, for example - there is a fair amount of basic security guidance in there. –  Rory Alsop Nov 30 '10 at 16:37

2 Answers 2

up vote 3 down vote accepted

He could cherry pick from the various security benchmark/checklists offered by:

http://cisecurity.org/
The Center for Internet Security (CIS) is a non-profit enterprise whose Benchmarking and Metrics Division helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. The Division provides enterprises with consensus best practice standards for security configurations, as well as resources for measuring information security status and for making rational decisions about security investments.

http://iase.disa.mil/stigs/checklist/
Defense Information Systems Agency (DISA)

http://web.nvd.nist.gov/view/ncp/repository
http://csrc.nist.gov/fdcc/faq-common_security_configurations.html The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 1, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

Next, spin up a couple Unix based systems on Amazon EC2 or Linode (lots of distributions to choose from).

Then setup & install OSSEC and gain experience reading and understanding the alerts generated by OSSEC (host intrusion detection system).

Bonus: Install and/or fire up a few services & applications (ssh/ftp/mail/dns/pop/http/etc.) and expose them to the public Internet. The more the merrier (i.e. more logs will be generated and more OSSEC alerts will be triggered).

share|improve this answer

Sounds like the first thing he'll need to do is to get up to speed with modern *nix. Set him a specific, measurable,...,time-bound challenge. How about setting up a Linux-based honeypot? That will mean researching the configuration and auditing side of things. There's not much point looking for training until he's got some familiarity with the problem domain.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.