12 ms·

What, if any, advice would you offer someone who would like to begin learning about security today?

wiseleo 7y ago
Start with understanding Unix file permission system and the meaning of /etc/services. It will snowball from there. You need to be proficient in Unix operating systems to have a knowledge base.
- bamboozled 7y ago
  With all due respect, the question was about more modern times. I feel like this was better advice in the 90s and early 2000s. It's not like knowing those things is bad, I just don't know how applicable it is now. Today the scope is far too big and there are far too many different hacking disciplines now. The advice above was probably more suited to a time when people used to be granted shell access to university computers. We live in a world where people don't even run web applications in on servers anymore, rather containers hosted in cloud platforms. That said, you really should develop a sound understanding of how computers work at a low level, it doesn't have to be perfect; but it helps you understand how even modern systems can be flawed (under all the shiny cloud marketing, they're computers after all). I would start with doing a course like: https://www.nand2tetris.org/ https://www.nand2tetris.org/. Once that foundational knowledge is understood, learn how computer networks work (IP, TCP, UDP), network stacks and then higher level protocols like HTTP, HTTP(s) and other layer 7 protocols. Learning about databases is good too, basic SQL skills are useful. By this stage you will probably bee having too much fun building new things using all the knowledge you've acquired rather than breaking other peoples stuff; Then again I guess it can still be fun to experiment with that too.
  - wiseleo 7y ago
    The cloud is someone else's Unix computer. Understanding permissions leads to understanding of privilege escalation, interprocess communication, /proc, logging, avoiding logging, understanding /etc... Yep, that's where I would start.
    - bamboozled 7y ago
      You’re also just assuming everyone is running Linux I guess ?
watwut 7y ago
You need to figure out what you mean by security. Cryptography? Hacking devices? Stalking/anti-stalking, malware, etc? Hardening boxes? Penetration testing?
dredmorbius 7y ago
What is your (or your client's or firm's) risk model? What is within control? What is outside it? What are the risks of both non-action and action. Sean Gallagher's "Threaty McThreatface" model is actually among the better high-level approaches I've seen: • Who am I, and what am I doing here? • Who or what might try to mess with me, and how? • How much can I stand to do about it? • Rinse and repeat. https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/ https://arstechnica.com/information-technology/2017/07/how-i... See also EFF: https://ssd.eff.org/en/module/introduction-threat-modeling https://ssd.eff.org/en/module/introduction-threat-modeling As you pursue the basic questions, you'll find yourself looking at specific threats, and the means (mechanisms, technologies, techniques) of addressing them. Bruce Schneier and Freedom to Tinker are other good starting points -- ports of entry, not your be-all, end-all. More broadly, this "start from a broad question, follow the implications" approach to research is a useful one in general.

Start with understanding Unix file permission system and the meaning of /etc/services. It will snowball from there. You need to be proficient in Unix operating systems to have a knowledge base.

bamboozled 7y ago
With all due respect, the question was about more modern times. I feel like this was better advice in the 90s and early 2000s. It's not like knowing those things is bad, I just don't know how applicable it is now. Today the scope is far too big and there are far too many different hacking disciplines now. The advice above was probably more suited to a time when people used to be granted shell access to university computers. We live in a world where people don't even run web applications in on servers anymore, rather containers hosted in cloud platforms. That said, you really should develop a sound understanding of how computers work at a low level, it doesn't have to be perfect; but it helps you understand how even modern systems can be flawed (under all the shiny cloud marketing, they're computers after all). I would start with doing a course like: https://www.nand2tetris.org/ https://www.nand2tetris.org/. Once that foundational knowledge is understood, learn how computer networks work (IP, TCP, UDP), network stacks and then higher level protocols like HTTP, HTTP(s) and other layer 7 protocols. Learning about databases is good too, basic SQL skills are useful. By this stage you will probably bee having too much fun building new things using all the knowledge you've acquired rather than breaking other peoples stuff; Then again I guess it can still be fun to experiment with that too.
- wiseleo 7y ago
  The cloud is someone else's Unix computer. Understanding permissions leads to understanding of privilege escalation, interprocess communication, /proc, logging, avoiding logging, understanding /etc... Yep, that's where I would start.
  - bamboozled 7y ago
    You’re also just assuming everyone is running Linux I guess ?

watwut 7y ago

You need to figure out what you mean by security. Cryptography? Hacking devices? Stalking/anti-stalking, malware, etc? Hardening boxes? Penetration testing?

dredmorbius 7y ago

What is your (or your client's or firm's) risk model? What is within control? What is outside it? What are the risks of both non-action and action. Sean Gallagher's "Threaty McThreatface" model is actually among the better high-level approaches I've seen: • Who am I, and what am I doing here? • Who or what might try to mess with me, and how? • How much can I stand to do about it? • Rinse and repeat. https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/ https://arstechnica.com/information-technology/2017/07/how-i... See also EFF: https://ssd.eff.org/en/module/introduction-threat-modeling https://ssd.eff.org/en/module/introduction-threat-modeling As you pursue the basic questions, you'll find yourself looking at specific threats, and the means (mechanisms, technologies, techniques) of addressing them. Bruce Schneier and Freedom to Tinker are other good starting points -- ports of entry, not your be-all, end-all. More broadly, this "start from a broad question, follow the implications" approach to research is a useful one in general.