0

I asked an experienced person about the needs of malware analysis. He told me:

"Learn x86, C/C++, Win32 API, Windows internals, PE file structure basics... Then when you are comfortable with these, try tools like ollydbg and IDA Pro."

But I have a question.

How much "Network knowledge" is needed for a malware analyst? Just need to learn Network+? or do I need Security+?

3 Answers 3

0

The basic answer that you got was learn everything as much as possible. That is the correct answer, I'm afraid. In your malware analysis you will encounter software that has been written by someone with very specific knowledge of certain aspects of networking, programming etc. You will need to learn that knowledge too on every occasion.

If you want to become a successful malware analyst, you must have a large base knowledge. You cannot analyse malware that does something on the network, if you need to brush-up on your network knowledge. In (admittedly older) books, I would say that Stevens' "TCP/IP Illustrated", volume 1-3 is a good basic knowledge for the required networking skills. Do not expect that there is a course that teaches you these skills.

Unfortunately, there are no certifications either. That means, that it will be hard to convince HR departments that you have certain knowledge. So, by all means, get the Network+ and Security+ certification. But do not think that you gain sufficient knowledge with that.

I should perhaps rephrase that: NEVER think you got enough knowledge.

0
0

Basics of networking should be crystal clear; there are certain cases where malware interacts with other machines on network or communicates with some server so to understand that, networking is a must.

0

Network+ teaches you how to configure a router and set up your own networks. That's not the knowledge you need.

You would need to understand how networks work, and how programs interact with a network. You need to understand TCP/IP really well. There is no "certification" for that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .