4 ms·

Well if that's the case, then times are changing ;) I study at the VU University of Amsterdam and took a couple of courses from the security master track. I had

Well if that's the case, then times are changing ;) I study at the VU University of Amsterdam and took a couple of courses from the security master track. I had to use libnet to create my own custom TCP/IP packets, libpcap to listen to incoming packets (tcpdump for debugging). Obviously, I did a SQL injection, cross site request forgery, cross site scripting and debugged malware with IDA Pro and later (when it was safe) with GDB. Did I talk about the concolic execution framework Triton that I used in combination with PIN to gather formulas for an SMT solver so we could crack the code of a binary? We did more things, I remember taint analysis being one of them with a PIN tool. Well, you get the point. I don't know if we're a special snow flake. I like to think we aren't, but the way the courses have been taught to me is that writing code, breaking things and debugging (lots of it) are the norm in security. Smart conceptual thinking helps sometimes as well. So I have this (untested) view of the world that other security master degrees also let you code in C, Python and whatever else you need to analyze or break into a system. It would frankly be catastrophic if this isn't the case. For me it was also a really interesting introduction to C! :) My main languages are Java, Python and Objective-C (where everything is a pointer, so I got away with not understanding it). My only criticism is that some situations seemed a bit contrived, but on the other hand it improves practice because you know what to focus on. Another was that some parts were purely theoretical and had no practical assignment (e.g. return oriented programming). Cool website to learn a couple of things more: https://www.win.tue.nl/~aeb/linux/hh/hh.html https://www.win.tue.nl/~aeb/linux/hh/hh.html

s_q_b 11y ago
Yes, times are changing. These universities offer far less while churning out Masters' degrees. No company I have ever worked for in this area had cybersecurity degrees that could code. Ever. I work for the National Satellite Operations Facility (NSOF.) Neither my boss nor the three dozen or so "cybersecurity" folks with whom I've worked have ever written a line of code. Also, everything you said in the first two paragraphs I either already knew from actual networking security courses, or are trivial. SQL Injection, CSRF, and dynamic executable analysis are unfortunately... Not the most modern techniques... Might as well teach naked buffer overflows. That said, it's a decent basis. And far far better than what's emphasized on this side of the pond (Mostly policy and automated scanners.) If what you're saying is truly reflective of "cyber" degrees across the EU, here it's far worse. It's very frustrating to explain a DNS tunnel to these people, much less how to find a zero day in Cisco IOS. Occasionally you'll get a hobbyist with some Python or C under their belts, but the vast majority of these "cyber" guys really should just read a book on Kali Linux and sing campfire songs in class for the rest of the year. Right now these degree programs are turning out graduates that think running Nessus makes them a security god. Things may well be different in Europe (I'm not going to lie, the Trident and PIN projects sound pretty cool), but it's a nightmare over here. If you're ever in DC, look me up, we'll have lunch, I'll give you a tour of the facility, and I can introduce you to the cyber guys, and let you draw your own conclusions. That's a pretty open invitation by the way. Any devs, start up folks or "cyber" people (that won't freak out my girlfriend) are welcome to crash in our guest room for a night or two, if you're in DC for a conference or something.

s_q_b 11y ago

Yes, times are changing. These universities offer far less while churning out Masters' degrees. No company I have ever worked for in this area had cybersecurity degrees that could code. Ever. I work for the National Satellite Operations Facility (NSOF.) Neither my boss nor the three dozen or so "cybersecurity" folks with whom I've worked have ever written a line of code. Also, everything you said in the first two paragraphs I either already knew from actual networking security courses, or are trivial. SQL Injection, CSRF, and dynamic executable analysis are unfortunately... Not the most modern techniques... Might as well teach naked buffer overflows. That said, it's a decent basis. And far far better than what's emphasized on this side of the pond (Mostly policy and automated scanners.) If what you're saying is truly reflective of "cyber" degrees across the EU, here it's far worse. It's very frustrating to explain a DNS tunnel to these people, much less how to find a zero day in Cisco IOS. Occasionally you'll get a hobbyist with some Python or C under their belts, but the vast majority of these "cyber" guys really should just read a book on Kali Linux and sing campfire songs in class for the rest of the year. Right now these degree programs are turning out graduates that think running Nessus makes them a security god. Things may well be different in Europe (I'm not going to lie, the Trident and PIN projects sound pretty cool), but it's a nightmare over here. If you're ever in DC, look me up, we'll have lunch, I'll give you a tour of the facility, and I can introduce you to the cyber guys, and let you draw your own conclusions. That's a pretty open invitation by the way. Any devs, start up folks or "cyber" people (that won't freak out my girlfriend) are welcome to crash in our guest room for a night or two, if you're in DC for a conference or something.