Hot answers tagged

44

I don't know a good reference to point to for further reading. Thus I will try to list a few time-wasters that I personally enjoy. In the following I will allow myself to differentiate between various styles of hacking competitions. I don't know if this is a canonical approach, but it will probably help explaining the differences between the ones I know: ...


41

IT in general, IT security in particular, is an area where you should always learn. When you do not want to learn any further, then it is time to retire. Therefore, you should already be eager to learn TCP/IP, and your question should be: "do I learn TCP/IP first, or is there something more urgent ?" Knowing the internals of TCP/IP is an invaluable tool for ...


41

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite knowledgeable in IT, but also managers and other non-programmers, so I tried to keep it fairly general, and not to technically complicated. As someone else pointed ...


36

Free options are few, but there are tons of videos and tutorials on specific attack vectors or products/tools. They will NOT make you a Penetration Tester, but they are free learning resources. Some decent options to start you off: MetaSploit Unleashed: Learn an exploitation framework SecurityTube: various videos covering a multitude of topics NMap: The ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


33

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


32

The canonical resource for the concept of secure-by-design is "The Protection of Information in Computer Systems" by Saltzer and Schroeder. The essence is distilled into their 8 principles of secure design: Economy of mechanism Fail-safe defaults Complete mediation Open design Separation of privilege Least privilege Least common mechanism Psychological ...


31

Interesting question. My thoughts on this are that obscuring information is helpful to security in many cases as it can force an attacker to generate more "noise" which can be detected. Where obscurity is a "bad thing" can be where the defender is relying on that obscurity as a critical control, and without that obscurity, the control fails. So in ...


29

For conciseness, I'll only add two: OWASP's moderated blog - they aggregate quality posts from a lot of diverse security feeds, mostly around new attacks, vectors, etc. Microsoft's SDL blog, mostly focusing on remediation strategies, mitigation, threat modeling etc, and also once in a while a very open, honest analysis of discovered security flaws and the ...


27

None. Generally speaking, certifications in the security field, much like most other tech areas, are required only for entry-level positions (when you have no experience to speak of), senior positions (when you need the long signature), and government jobs (when you need to answer an RFP to work there). By themselves, none of these are a replacement for good ...


25

Consider the usual risk management statement: Don't spend 1000$ to protect 100$ Now, it might just be a situation that the execs are not aware that what they want will cost 1000$; more likely that they just don't realize that they're only protecting 100$ worth. If that is the case, you could consider trying to implement methodology that will ...


23

There is no defined blueprint on what is the best language to learn. Therefor I would like to mention two good alternatives that I (and many otheres) think is a good languages to learn in computer security. LUA Explanation of Lua from wikipedia: Lua is a lightweight multi-paradigm programming language designed as a scripting language with "extensible ...


22

You could check out www.cccure.org - it was always the one I recommended folks go to when I used to teach CISSP. I have just checked it out and it has even more material than it did 5 years ago. It requires free registration, but then you have access to documentation and practice tests. (and good luck!)


21

I'd suggest in additiona to HamZa DzCyberDeV's answer: Pentester Labs exercises which are full VMs as well as full detailed walkthroughs etc. These are great for all skill levels and i've found them most useful.


21

Depending on what you call "online", a simple Google search on "damn vulnerable" will reveal the existence of freely downloadable applications of even full OS, meant for, indeed, learning all the ways software can be horribly vulnerable. One of them is Damn Vulnerable Web App, which is, you guessed it, a damn vulnerable Web app. There also used to be a full ...


20

There's a couple of good ones in addition to DVL, that I've come across Metasploitable is designed for testing out some of Metasploits functionality. There's some good information on using it in the free Metasploit Unleashed course. There's also DVWA from a web applications perspective EDIT: Another good list I came across on a blog recently, has quite ...


19

Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community. exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, ...


19

It will be hard to teach design principles in 30 minutes. I agree with others who say that you have to get them excited in some fashion. I developed the "Elevation of Privilege" card game to get people excited about threat modeling, it might be helpful. ...


18

i am going to list down a couple of resources i follow to keep up to date on security issues: Security Focus: you will find a slew of information on that website about vulnerabilities and all sorts of both general and specific topics related to security. it also hosts a slew of mailing lists dealing with different aspects of information security. Bruce ...


17

One of the things I've been most impressed by in the last few years is the new focus on security as being a balance between cost and risk. A security solution should not be implemented if the cost exceeds the risk of exploit, and both costs and risks can be hard to diagnose. The thing I like most about this core concept is that it basically mandates the ...


17

As someone who spends a lot of time listening to podcasts I'll rattle off a few I've found to be very enjoyable. Eurotrash Security Podcast Probably my favourite podcast as it's European albeit a bit light on technical content. News and chat based mainly. They cover a lot of the conferences which is good if you can't get to many (like me). The European ...


16

For Reverse Engineering: The University of Helsinki in collaboration with F-Secure offer a course titled Malware Analysis and Antivirus Technologies which has the curriculum available online. For Secure Coding: CERT is always a good reference, especially for C & C++. They have a Secure Coding in C and C++ course at SEI @ CMU.


16

I am partial to the appsec side of penetration-testing. Hunting Security Bugs The Art of Software Security Assessment Secure Programming with Static Analysis Open-Source Fuzzing Tools Fuzzing for Software Security Testing and Quality Assurance Gray Hat Hacking, 3rd Edition Advanced Windows Debugging How to Break Software Seven Deadliest Web Application ...


16

This is great that you are doing so much learning on your own. You are on the right track. Your enthusiasm to learn on your own will put you a step above a lot of your competition. Kudos. My main advice would be: don't worry too much about planning out a path through all the material you want to learn. You don't need a carefully thought-out plan. ...


16

Edit: I'm an OSCP now, and you can read my review here, but to briefly answer your question. OSCP is nothing like C|EH, SSCP or any of the other courses I know that are out there. It is extremely practical and leaves tons of opportunities for further research and development on your own. If you're looking to learn something new or establish ground in I.T. ...


16

Yes, math is a tool and it can be useful in the realm of computer security. A fair amount of math is required to obtain a degree in Computer Science, and hackers prey on software developed by computer scientists. Algebra can be used to fool GPS, and detect doctored photographs. Computer Science theory is a branch of math and has applications to ...


16

Do it as part of new employee orientation and follow up with more training at regular intervals. Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.


15

Here are some of my favorite sites to follow (I use RSS for all of them): In-depth about binary numbers, with some recent security-relevant posts http://www.exploringbinary.com The SANS Internet Storm Center, for Internet security alerts http://isc.sans.edu InfoSec News list, for consolidated security news http://www.infosecnews.org/ SecurityNow podcast ...


15

These are all that i recommend. Web Vulnerability 1. Webgoat(Recommend) - https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project 2. EnigmaGroup(WarGame) - http://www.enigmagroup.org 3. Mutillidae(Good) http://sourceforge.net/projects/mutillidae/ 4. DVWA (not so good) http://www.dvwa.co.uk/ OS Vulnerability 5. Metasploitable(Recommend) - ...


15

None of the existing answers mention this and its too long for a comment even if its not a thorough answer. One thing you will absolutely need to avoid engendering in your audience is nihilism (i.e. I will get hacked no matter what I do). Its quite easy to scare people s@#$less (and temptingly entertaining depending on circumstances). But big part of ...



Only top voted, non community-wiki answers of a minimum length are eligible