networking and security

Question

I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about relevant linux configuration tools), but I do want a solid foundation in networking to the point where I can have a conceptual grasp of what's going on (how protocols, DNS, DHCP and ALL these things interact) and be comfortable analyzing packets. By a reasonable amount of time I mean 25 days or so. Is this feasible?

I'm trying to find resources, but books on networking inevitably start going into a lot of details on the protocols. I'm not sure if it's an effective use of my time to learn every single protocol. But maybe it is? I don't know.

Can someone offer advice or good resources?

Maybe reasonable was a bad word.

Answer 1

Yes, this is feasible, but you will need to study intensively.

I have some recommendations that may help in learning this material:

1. Learn about TCP/IP. I recommend TCP/IP Illustrated, by Stevens, but any other network book may be a fine alternative. Anotehr useful textbook may be Computer Networking: A Top-Down Approach by Kurose and Ross. Make sure to learn about how things like IP, TCP, UDP, DNS, HTTP, DHCP, and ARP work.

2. Learn about firewalls. I recommend Firewalls and Internet Security by Cheswick, Bellovin, and Rubin. This is an outstanding book that will teach you about more than just firewalls. In the process of learning about firewalls from these authors, you will also learn how to think like a security expert, and you will learn a variety of security risks associated with computer networks.

3. Learn how to configure a firewall. I recommend learning how to set up a IPTables firewall. Don't just read about it; install Linux on your machine and write the IPTables firewall rules to build your own firewall. Experiment and learn how to do it yourself. This kind of hands-on knowledge will be very valuable.

4. Learn how to use Wireshark. Spend some time analyzing packet capture dumps and reading through them to understand everything you see. Play around. This will give you some great hands-on knowledge.

5. Learn about how HTTPS (SSL/TLS) works. There are many sources that explain it well.

6. Learn about the Kaminsky attack on DNS. It is educational. I recommend these two articles: Reliable DNS Forgery in 2008: Kaminsky’s Discovery and An Illustrated Guide to the Kaminsky DNS Vulnerability.

7. Learn about network intrusion detection systems (NIDS). They are a good tool to know about.

8. Read Steve Bellovin's paper A look back at Security Problems in the TCP/IP Protocol Suite.

Answer 2

Understanding how a network actually works is tightly connected to the fact that Computer Networks and how they are integrated into systems, have a hierachichal structure. Learning the rules and behaviours of each level of this structure is fundemental to understanding how computer networks and protocols behave in each and every situation.

I recommend starting to learn how this hierarchical system (Called OSI : Open Systems Interconnection) behaves. and trust me, if you get how it works, understanding how any other Protocol (DHCP, DNS, HTTP or even SSL, PPP and other lower level protocols) or even Stack Protocol (be it TCP/IP, AppleTalk, etc) operates would be a piece of cake.

1. I Recommend starting one of the Network+ books (Syngress Publications Perhaps...) to get your core up & running. that would mean understanding loads of theoretical concepts and things that you won't be able to deploy but just learn...

you mentioned that you don't want to start learning ALL of the protocols and how they work. The Second part helps you narrow down your choices of protocols (because not all of them are applicable in every condition and in many cases you don't need to learn most of them).

2. Now for the Implementation part, I suggest reading certification books such as MCITP Series from Microsoft (Focus on the Network Infrastructure Part of the Exam) or getting ready for the LPIC exams... I'm not implying that you should take the exams because even getting ready for them means that you have read the books and implemented the exercises (such as DHCP & DNS Servers)...

Video Learning also works just fine... it's a combination of conceptual and deployable means for understanding how a network protocol operates and behaves...

Hope this helps and sorry for the huge amount of text ! can't seem to help it...

Answer 3

I'm trying to pick up networking security within a reasonable amount of time... Is this feasible?

Yes, it most certainly is. But with two caveats:

1. You'll need to spend a good amount of time each day studying (not just reading a chapter a day and calling it good).
2. You'll need to invest a lot more time applying what you've learned. Applying your knowledge is incredibly important, as it promotes the retention of knowledge and improves your understanding of concepts.

I'm trying to find resources, but books on networking inevitably start going into a lot of details on the protocols. I'm not sure if it's an effective use of my time to learn every single protocol. But maybe it is? I don't know.

This depends largely on what your goals are, or rather how you wish to apply your networking knowledge. In your case, it sounds like you would be best suited for learning networking on a high-level and packet analysis on a low-level. It is important to learn the high-level fundamentals first, otherwise when you start digging into packet analysis you will just get confused.

For actual resources, I recommend going to a bookstore and just start reading books on networking. Most books that are aimed at beginners will spend at least the first few chapters just covering the basics/fundamentals that you need to know about. My favorite book on the subject was my TCP/IP Illustrated college textbook, though it gets pretty in-depth at times. For actually applying your knowledge, a book like Practical Packet Analysis may be a good start.

Answer 4

One thing I should point about this question is:

if you want to learn and stick something in your mind, just CODE it !

I think with this method you can understand complex concepts more thoroughly. In networking, keep using Java,C or C++ or some useful application as a helper method besides books or papers. One of these useful applications is Wireshark. Implementing an API will be a great approach to understanding a lot of things that happen inside network systems.

Answer 5

Depending on your level of knowledge, this may be of interest...

Recently I learned that a professor at RIT has been making a series of youtube videos going over basic network protocols and packet analysis. He calls it The Chicken Protocol and it seems to be meant for beginners. He even has a "Packet of the Week" (PoW) which he goes over. So if you're interested in how to start, maybe taking a quick look at some of the PoWs and seeing what you can make out from them is something to try. And then watch the solution video to see how close you are. Though I said it seems to be mostly beginner stuff, the PoWs are given in hex, so you would be manually doing the breakdown that wireshark gives.

P.S. I haven't actually watched all of his videos, but it is Bruce Hartpence so I'm sure they're effective. If you want some refereances, he wrote the Core Network Protocols and Routing and Switching O'REILLY books.

Answer 6

You seem to want something specific, so I'm going to take a different approach than the others and offer a single solution to your constraints.

One word: Wireshark.

The Tool
The tool is free and is in the top 3 tools network pros use regularly. It is possibly the best tool for packet analysis. I taught networking and protocols as a Department Head for a technical school, and I continue to learn more from Wireshark than I could from any other source. It helps you understand both the technical details of protocols as well and the overall concepts.

The Training
The other reason to focus on Wireshark as the omnibus approach to your question is the books and training available. Yes, there is a certification, but that need not be the focus. The training will walk you through the practical aspects of protocols without delving too deeply into the theory, which seems to be what you are hoping for.

The Freebies
Wireshark also comes with collections of packet captures for you to dissect and analyze, which can enhance your learning in both packet concepts as well as security applications.

Using this targeted approach, I truly believe that you could:

• avoid 'all the little tools' while gaining a better understanding of the tools you then choose to pick up
• gain a good foundation in applied protocol theory
• gain familiarity and experience with packet analysis
• accomplish something worthwhile in 25 days

Augmenting the Study Plan
As you run into questions or when you want to know more about what you are looking at in a packet dump, start working through @D.W. 's list.

Study Plan Advice
My other advice is to pursue the areas that interest you the most because 'security' is such a wide field. You seem to focus on packet-level security, so do that, and build knowledge there than can be transferred to other areas as you become interested.

I hope this triggers some ideas for you.

Answer 7

A lot of really good answers here with some great resources. Consider another approach if you have a budget.

https://www.sans.org/security-training/security-essentials-bootcamp-style-61-mid

This is a really great foundation of security knowledge. I'm not affiliated with SANS but I have taken and certified in 3 of their courses.

Answer 8

Network related:

• Books:

  Computer Networking: A Top-Down Approach

  Internetworking with TCP/IP

Security related:

• Certified Ethical Hacking(CEH) gives you a good approach on network security. It gives good guidelines & reviews most important tools aswell, such as Snort, wireshark and more.

  - Some of what the course covers:(Also, there are video tutorials/books covering the course)

  Fundamentals of Ethical Hacking. Footprinting Scanning technologies.
  Enumeration.
  Trojans, backdoors, worms, and viruses .
  Session Hijacking.
  Denial of Service.
  Hacking of Systems, Web Services, and Linux.
  Cryptography.
  Penetration Testing.
  

• BackTrack Linux is an OS Ubuntu based. It has a lot of built-in tools to test the network. You'll need it, if you ever need to test your network against vulnerabilities.

• As for books, Linux Server Security by Michael D. Bauer

An Advice, you might get bored with having to study networking all the time. If you intend to go a step towards programming, I'd recommend python. Even for a network admin, it's a great scripting tool that you can use to automate network and security tests & functions. Also, it's easy to learn.

Another thing is always keep up-to-date in field of cyber security, there's always going to be something new everyday. Be subscribed to security newsletters/websites such as SANS ones.

Answer 9

Try finding material covering the Network+ certification.

http://www.professormesser.com/n10-005/free-network-plus/

Answer 10

I just finished taking a network forensics course, and the site that we used was asecuritybook.com They give you a lot of tutorials and hands on examples. There is also a book which you can order that was very good. The book is "Introduction to Security and Network Forensics" by William J Buchanan. The site that I noted is also updated and maintained by him. Hope this helps!