Perhaps I am being both naive and overly ambitious in my first post but I have a huge interest in learning about network and system security and am at a loss as to where to begin. I realize that stack exchange sites are not too keen on having large broad sweeping questions with potentially opinionated answers, but I thought it would be a great idea to ask a multitude of basic security type questions and perhaps it could be compiled into a sticky or faq, to help out newbies and prevent similar questions from being asked ad nauseam. If something similar exists, then perhaps I could be guided to such resource(s) before this topic is closed.

Before I begin with my questions I should make clearer exactly why I am asking them in the first place. I am just starting to delve deeper into my understanding of Unix and Win based systems. The more I delve, the more I realize how important security is, and how little I actually understand the topic. I have attempted to read into the subject by pouring through several security handbooks, technical manuals, and forums and I inevitably run into the same issues and confusion.

A. Info is diffused among 1000s of books, sites, and forums.

B. Info is rife with technical jargon that needlessly complicates comprehension.

C. Often, examples are given as solutions but are not accompanied by explanations as to why commands are run and exactly what one should be looking for when doing so.

I am by no means an IT expert but I would like to either compile or discover a resource that allows basic skilled users to create a secure system/network to deter hackers.

Once again I realize this may be too ambitious for one post but hopefully you won't fault me for trying. As such, here are my questions. Please specify where applicable if your info pertains to Unix or Win based systems.

Question 1- IP Address, Subnet Masks, DNS Servers, Proxies, MAC addresses, ports, TCP/IP, UDP and perhaps more I am missing. Is there one single resource that effectively explains how these often very similar looking numbers and systems relate to one another? I especially get mind-twisted by these systems because for example with IP addresses, I never know when a reference is talking about my router IP, host IP, individual computer IP, etc. and when you throw ports into the mix it becomes even more of a number tangle.

Question 2- How would you set up and arrange the hardware of your network? Would you use a hardware firewall? If so where would the hardware firewall be located in the network? Is there any other hardware that could be added to the network to improve security. What settings should be used at the hardware level to minimize outside access?

Question 3- What are some good general settings for firewalls to mitigate outside access? Does MAC address filtering do anything useful or is it too easy to work around it? How do you balance allowing local users to have maximal access while mitigating security holes?

Question 4- I often see recommendations to close ports. Does this in reality make anything more secure or will hackers merely use the few ports you must have open for basic usage? Also does the port number effect how and what information can be sent through it or are they merely conventions ex. port 80 being http only or can malicious people send other types of data through it?

Question 5- What commands should [Unix] or [Win] users run on a [daily], [weekly], [monthly] basis to check for malicious processes? Please explain these commands in depth and what a user would be scanning for in particular. What log files are useful to monitor?

Question 6- What routine(s) do you use in your daily workflow (especially for those employed as system or security administrators) to mitigate risk and actively check for weak links? Do you use a suite of software, or manually check logs? Do you rely on scripts and if so, when do you make the decision to make a slightly deeper manual search? What forms of authorization do you use? What do you feel are the inherent strengths and weaknesses of such authorization system(s)?

Question 7- Are you fearful that 3rd party softwares could potentially add backdoor security breaches to your system? If so, how do you address this issue if the source code is not open source?

If you can think of any other pertinent advice feel free to add.

  • 2
    It's really difficult to answer such a huge question in a single answer as I suspect lots of different people will have lots of different answers for only a subset. I would recommend breaking each question out into its own post as otherwise this'll likely just get closed. – Steve Jan 20 '14 at 23:46
  • These are all very good questions to ask, but you haven't asked them in a way that will help us answer you. – schroeder Jan 21 '14 at 1:50
  • First of all, I upvoted because you clearly put some thought into this post and the questions are indeed good starting points for beginners. However I'm not sure this is a good place to ask them: the answers would vary a lot and would mostly be rather long because it are broad subjects. I think an ideal answer might be a short book actually. If you still want to go ahead with making this beginner's FAQ, you could google around for answers and ask more specific questions on this site. I think those would generate some great answers, the amount of thought you put into questions seems good ;) – Luc Jan 21 '14 at 2:09
  • 2
    @RattleSnake That is sadly not how the Stackexchange network works. We focus on answering one specific question at a time. This isn't a traditional forum where posts can be pinned to the top of the page. – user10211 Jan 21 '14 at 3:44
  • 1
    Let me help you sorting them: Question 1 is for NetworkEngineering. | Question 2 is too broad, different network configurations may require different firewall position, but you can ask it and give it a try | Question 3 and 4 this question is for security and you will find some answers | Question 5 is too broad, is not a doubt is a full manual, but it deserves a try around here | Question 6 this will vastly depend on the systems/configurations, so it is too broad | Question 7 this is fine and you can give it a try around here as well. Kind regards. – kiBytes Jan 21 '14 at 6:47

For the networking stuff I would suggest buying a CCNA book, if your not planning on doing a CCNA exam you can get the course books cheaper from Amazon, they have lots of general networking knowledge.

For remote exploits I would look into buffer overflows Hacking: The Art of Exploitation

The NSA has pretty much back doored everything these days even encryption standards so the only way to mitigate it is to pretty much stay off the internet

| improve this answer | |

I'm going to attempt very quick answers to your questions:

1) I've found that online searches (e.g. Wikipedia articles) explain these concepts well. If you hit jargon you can always search to understand the jargon.

2) Generally yes, people always use a hardware firewall, whether it's built into the router on a small home network, or a high-end dedicated firewall in an enterprise. The normal setup is to have a DMZ for internet-facing systems like web servers, and an internal network for workstations, and fully internal systems like an intranet.

3) The general rule is to block by default and only allow what you need. Usually you only allow inbound connections from internet to DMZ, not internet to internal. Some networks just allow all outbound connections, but a more secure approach is to only allow specific outbound connections from the DMZ, and from the internal force all connections through a proxy. The proxy lets you do higher-level filtering (e.g. this group of users is not allowed to access Facebook).

4) Yes, closing ports that are not used does help. You are correct that it is not a complete solution, as the ports you need to be open can be attacked, but it does help. Most Linux distributions are well locked down out of the box, and with Windows you normally use a personal firewall to protect the ports that are open by default.

5) For a non-specialist, simply run a full scan of your computer using your anti-virus program. A specialist can do more than that.

6) For prevention, vulnerability scanning tools like Nessus for Secunia PSI. If you're developing software, perhaps a web scanning tool or a static code analyser. You can also use intrusion detection system (IDS) software to detect attacks, but this requires a level of sophistication. Many enterprises outsource management of their IDS.

7) Yes I do worry, but there's not a lot that a non-specialist can do about this. The best approach is to minimise the amount of software you use.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.