I have a top notch Windows MCSE/MCSD (developer) who wants to broaden his skills with Linux security... but needs to update his skills from the Ultrix / Yellowpages days of 40 years ago.

What resources should I point him to? I'm hoping to find things that will go at a decent pace for someone of his caliber.

To scope this a bit, I'm mostly interested in (1) reading and analyzing logfiles (2) host level security common to most distributions of Linux

  • This guys is both an MCSE (sysadmin) AND an MCSD? and you're gonna waste his time with reading logfiles?
    – AviD
    Nov 23 '10 at 21:37
  • not a waste of time if you mix the skills together; and sell it at www.eventvwr.com :) Nov 23 '10 at 21:45

He could cherry pick from the various security benchmark/checklists offered by:

The Center for Internet Security (CIS) is a non-profit enterprise whose Benchmarking and Metrics Division helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. The Division provides enterprises with consensus best practice standards for security configurations, as well as resources for measuring information security status and for making rational decisions about security investments.

Defense Information Systems Agency (DISA)

http://csrc.nist.gov/fdcc/faq-common_security_configurations.html The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 1, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.

Next, spin up a couple Unix based systems on Amazon EC2 or Linode (lots of distributions to choose from).

Then setup & install OSSEC and gain experience reading and understanding the alerts generated by OSSEC (host intrusion detection system).

Bonus: Install and/or fire up a few services & applications (ssh/ftp/mail/dns/pop/http/etc.) and expose them to the public Internet. The more the merrier (i.e. more logs will be generated and more OSSEC alerts will be triggered).


Sounds like the first thing he'll need to do is to get up to speed with modern *nix. Set him a specific, measurable,...,time-bound challenge. How about setting up a Linux-based honeypot? That will mean researching the configuration and auditing side of things. There's not much point looking for training until he's got some familiarity with the problem domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.