RE: TCP/IP skills

From: Vaccare, Anthony (RVaccare_at_ola.state.md.us)
Date: 07/08/04

  • Next message: Dave Dyer: "RE: TCP/IP skills" 
    Date: Thu, 8 Jul 2004 15:30:38 -0400
To: <pen-test@securityfocus.com>, <vuln-dev@securityfocus.com>

    Believe it or not, a co-worker, who didn't have even a basic
    understanding about TCP/IP, packets, headers, IP addressing and
    subnetting, was sent out with me to review a router! It was the worst
    TWO months of my career. This person was not new to IT either - approx.
    7 years in the field! I was appalled at some of the questions he asked.
    Needless to say, I let him know it was not my job to teach him the
    fundamentals of TCP/IP, so he'd have to do the best he could at
    answering the 'yes/no' questions on our questionnaire.

    -----Original Message-----
    From: Vlad [mailto:vladkors@gmail.com]
    Sent: Thursday, July 08, 2004 4:39 AM
    To: Don Parker
    Cc: pen-test@securityfocus.com; vuln-dev@securityfocus.com
    Subject: Re: TCP/IP skills

    Here's a nice article Security Focus has published some time ago
    dealing with this very subject.

    TCP/IP Skills Required for Security Analysts
    http://www.securityfocus.com/infocus/1779

    As for my opinion, I can't agree more. Advance (IP) networking skills
    should be a vital and an inseparable part of a security experts'
    knowledge. Although there might be some exceptions, a "security
    expert" that lacks the basics of TCP/IP, that has no idea what a
    packet is constructed of, is nothing more then a script kiddie.

    Regards,
       - Vlad.

    On Tue, 6 Jul 2004 21:20:46 -0400 (EDT), Don Parker
    <dparker@rigelksecurity.com> wrote:
    > Hello all, I just wanted to comment on what I see as a rather alarming
    trend in the
    > security industry today. More and more many are becoming reliant upon
    tools to do their
    > job whilst they ignore core components of their skillset. Specifically
    in this case an
    > in-depth knowledge of TCP/IP.
    >
    > Knowing TCP/IP at a granular level in my opinion is very much a core
    skill that must be
    > attained by anyone who wishes to have a successful career in the
    network security
    > industry today. One cannot become adept by simply using tools, and
    never knowing how to
    > interpret the output by verifying the packets themselves.
    >
    > It constantly amazes me when I teach a TCP/IP Analysis course that
    people who are
    > presently in the industy do not know of such basic TCP/IP concepts as
    the 3 way
    > handshake and how ICMP works. That or being able to wholly dissect a
    packet and explain
    > the relationships between various metrics.
    >
    > I would be curious to hear of your opinions on this?
    >
    > Cheers,
    >
    > Don
    >
    > -------------------------------------------
    > Don Parker, GCIA
    > Intrusion Detection Specialist
    > Rigel Kent Security & Advisory Services Inc
    > www.rigelksecurity.com
    > ph :613.233.HACK
    > fax:613.233.1788
    > toll: 1-877-777-H8CK
    > --------------------------------------------
    >

    ********************************************************************************************************************
    This email and any file transmitted with it may be confidential and is intended solely for the use of the individual or entity to whom it is addressed. If you received this email in error please notify the DBM Service Desk by forwarding this message to servdesk@dbm.state.md.us.

    This email has been scanned by networkMaryland Antivirus Service for the presence of computer viruses.

  • Next message: Dave Dyer: "RE: TCP/IP skills"

    Relevant Pages

    • Re: Rather funny; looks like page defacement to me
      ... An admin who doesn't know TCP/IP? ... trained on networking and TCP/IP, security, etc. ... of those poor "draftees" how to protect their enterprise. ... Adjunct Information Security Officer ...
      (Focus-IDS)
    • Re: REVIEW: "Network Security for Dummies", Chey Cobb
      ... Hack Proofing Your Network: ... TCP/IP Illustrated Volume I: ... was compromised in numerous attacks in 2000 and 2002, ... A couple of books I'm thinking of getting are "Network Security Assessment" by ...
      (comp.security.misc)
    • Re: TCP/IP skills
      ... I have taken a few security courses, and have been using Unix for about ... knowledge of TCP/IP. ... >security industry today. ... That or being able to wholly dissect a packet and explain ...
      (Pen-Test)
    • Re: Rather funny; looks like page defacement to me
      ... Unfortunately this message seems to indicate that I said that sysadmins who ... What I said in the first place is that foisting IDS systems are ... An admin who doesn't know TCP/IP? ... trained on networking and TCP/IP, security, etc. ...
      (Focus-IDS)
    • Re: unspected shutdown. TCP attack?
      ... original debugging environment and see what is causing that problem. ... be your program has a bug that is bringing down the tcp/ip stack and causing ... >> I'll also hit one thing you may not have checked, in your local security ...
      (microsoft.public.win2000.networking)