SP security knowledge build up
Hello All, I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with? We are looking forward to building a concrete foundation of a well-rounded security engineer, we are looking for vendor/operator agnostic resources. Thanks, Ramy
The usual / canonical sysadmin book might work, there is a lot of security related material in there as well. https://www.amazon.com/Practice-System-Network-Administration-Second/dp/0321... And this updated for enterprise / devops and other such new fangled things https://www.amazon.com/Practice-System-Network-Administration-Enterprise/dp/0321919165/ref=pd_lpo_sbs_14_t_0?_encoding=UTF8&psc=1&refRID=2N4F09FPM9FG9VQNT433 On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish" <nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of ramy.ihashish@gmail.com> wrote: Hello All, I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with? We are looking forward to building a concrete foundation of a well-rounded security engineer, we are looking for vendor/operator agnostic resources. Thanks, Ramy
I thought also there was a set of videos from nanog meetings... I can't find a set, but here are some: ISP Security 101 primer https://www.youtube.com/watch?v=ueRminCpnMc isp security real-world techniques - 2 https://www.youtube.com/watch?v=Ijd9A5wUS_0 https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?) ISP Security toolkits https://www.youtube.com/watch?v=w7XcZS_99WQ NRIC Best Practices for ISP Security https://www.youtube.com/watch?v=1bzL5eUGC-0 there are actually quite a few more, searching for 'security nanog' turned up. On Mon, Jul 23, 2018 at 9:32 AM Suresh Ramasubramanian <ops.lists@gmail.com> wrote:
The usual / canonical sysadmin book might work, there is a lot of security related material in there as well.
https://www.amazon.com/Practice-System-Network-Administration-Second/dp/0321...
And this updated for enterprise / devops and other such new fangled things
On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish" <nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of ramy.ihashish@gmail.com> wrote:
Hello All,
I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with? We are looking forward to building a concrete foundation of a well-rounded security engineer, we are looking for vendor/operator agnostic resources.
Thanks,
Ramy
Barry Greene's site has some good info on ISP security as well: http://www.senki.org On 7/23/18, 8:08 AM, "NANOG on behalf of Christopher Morrow" <nanog-bounces@nanog.org on behalf of morrowc.lists@gmail.com> wrote: I thought also there was a set of videos from nanog meetings... I can't find a set, but here are some: ISP Security 101 primer https://www.youtube.com/watch?v=ueRminCpnMc isp security real-world techniques - 2 https://www.youtube.com/watch?v=Ijd9A5wUS_0 https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?) ISP Security toolkits https://www.youtube.com/watch?v=w7XcZS_99WQ NRIC Best Practices for ISP Security https://www.youtube.com/watch?v=1bzL5eUGC-0 there are actually quite a few more, searching for 'security nanog' turned up. On Mon, Jul 23, 2018 at 9:32 AM Suresh Ramasubramanian <ops.lists@gmail.com> wrote: > The usual / canonical sysadmin book might work, there is a lot of security > related material in there as well. > > > https://www.amazon.com/Practice-System-Network-Administration-Second/dp/0321... > > And this updated for enterprise / devops and other such new fangled things > > > https://www.amazon.com/Practice-System-Network-Administration-Enterprise/dp/0321919165/ref=pd_lpo_sbs_14_t_0?_encoding=UTF8&psc=1&refRID=2N4F09FPM9FG9VQNT433 > > > On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish" > <nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of > ramy.ihashish@gmail.com> wrote: > > Hello All, > > I am planning to build up a security team of fresh engineers whom are > "network oriented", any advice on the knowledge resources we can start > with? We are looking forward to building a concrete foundation of a > well-rounded security engineer, we are looking for vendor/operator > agnostic > resources. > > Thanks, > > Ramy > > > > E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
On 23 Jul 2018, at 22:30, Compton, Rich A wrote:
Barry Greene's site has some good info on ISP security as well:
Here're some more: <https://app.box.com/s/4h2l6f4m8is6jnwk28cg> This book is also highly recommended: <https://www.amazon.com/Router-Security-Strategies-Networking-Technology-ebook/dp/B0051TM5L2/> ----------------------------------- Roland Dobbins <rdobbins@arbor.net>
Thank you Christopher, Compton and Suresh, that was helpful. I am still looking for more. Does anyone want to recommend any MOOC? Thanks, Ramy On 23 July 2018 at 17:30, Compton, Rich A <Rich.Compton@charter.com> wrote:
Barry Greene's site has some good info on ISP security as well: http://www.senki.org
On 7/23/18, 8:08 AM, "NANOG on behalf of Christopher Morrow" < nanog-bounces@nanog.org on behalf of morrowc.lists@gmail.com> wrote:
I thought also there was a set of videos from nanog meetings... I can't find a set, but here are some:
ISP Security 101 primer https://www.youtube.com/watch?v=ueRminCpnMc
isp security real-world techniques - 2 https://www.youtube.com/watch?v=Ijd9A5wUS_0 https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?)
ISP Security toolkits https://www.youtube.com/watch?v=w7XcZS_99WQ
NRIC Best Practices for ISP Security https://www.youtube.com/watch?v=1bzL5eUGC-0
there are actually quite a few more, searching for 'security nanog' turned up.
On Mon, Jul 23, 2018 at 9:32 AM Suresh Ramasubramanian < ops.lists@gmail.com> wrote:
> The usual / canonical sysadmin book might work, there is a lot of security > related material in there as well. > > > https://www.amazon.com/Practice-System-Network- Administration-Second/dp/0321492668 > > And this updated for enterprise / devops and other such new fangled things > > > https://www.amazon.com/Practice-System-Network- Administration-Enterprise/dp/0321919165/ref=pd_lpo_sbs_14_ t_0?_encoding=UTF8&psc=1&refRID=2N4F09FPM9FG9VQNT433 > > > On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish" > <nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of > ramy.ihashish@gmail.com> wrote: > > Hello All, > > I am planning to build up a security team of fresh engineers whom are > "network oriented", any advice on the knowledge resources we can start > with? We are looking forward to building a concrete foundation of a > well-rounded security engineer, we are looking for vendor/operator > agnostic > resources. > > Thanks, > > Ramy > > > >
E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
Not a MOOC. But several schools now have graduate programs in security. Off the top of my head, Georgia Tech, UAB, GMU .. They might offer some shorter courses as well, for working professionals. Take a look. From: Ramy Hashish <ramy.ihashish@gmail.com> Date: Tuesday, 24 July 2018 at 2:33 PM To: "Compton, Rich A" <Rich.Compton@charter.com> Cc: Christopher Morrow <morrowc.lists@gmail.com>, Suresh Ramasubramanian <ops.lists@gmail.com>, nanog list <nanog@nanog.org> Subject: Re: SP security knowledge build up Thank you Christopher, Compton and Suresh, that was helpful. I am still looking for more. Does anyone want to recommend any MOOC? Thanks, Ramy On 23 July 2018 at 17:30, Compton, Rich A <Rich.Compton@charter.com> wrote: Barry Greene's site has some good info on ISP security as well: http://www.senki.org On 7/23/18, 8:08 AM, "NANOG on behalf of Christopher Morrow" <nanog-bounces@nanog.org on behalf of morrowc.lists@gmail.com> wrote: I thought also there was a set of videos from nanog meetings... I can't find a set, but here are some: ISP Security 101 primer https://www.youtube.com/watch?v=ueRminCpnMc isp security real-world techniques - 2 https://www.youtube.com/watch?v=Ijd9A5wUS_0 https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?) ISP Security toolkits https://www.youtube.com/watch?v=w7XcZS_99WQ NRIC Best Practices for ISP Security https://www.youtube.com/watch?v=1bzL5eUGC-0 there are actually quite a few more, searching for 'security nanog' turned up. On Mon, Jul 23, 2018 at 9:32 AM Suresh Ramasubramanian <ops.lists@gmail.com> wrote: > The usual / canonical sysadmin book might work, there is a lot of security > related material in there as well. > > > https://www.amazon.com/Practice-System-Network-Administration-Second/dp/0321... > > And this updated for enterprise / devops and other such new fangled things > > > https://www.amazon.com/Practice-System-Network-Administration-Enterprise/dp/0321919165/ref=pd_lpo_sbs_14_t_0?_encoding=UTF8&psc=1&refRID=2N4F09FPM9FG9VQNT433 > > > On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish" > <nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of > ramy.ihashish@gmail.com> wrote: > > Hello All, > > I am planning to build up a security team of fresh engineers whom are > "network oriented", any advice on the knowledge resources we can start > with? We are looking forward to building a concrete foundation of a > well-rounded security engineer, we are looking for vendor/operator > agnostic > resources. > > Thanks, > > Ramy > > > > E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 To add to Suresh's list, Iowa State University (iastate.edu) offers a graduate major program and an undergraduate minor program in cyber security (a.k.a. Information Assurance). They also run an annual cyber defense competition (ISEAGE). On 7/24/2018 4:06 AM, Suresh Ramasubramanian wrote:
Not a MOOC. But several schools now have graduate programs in security. Off the top of my head, Georgia Tech, UAB, GMU ..
They might offer some shorter courses as well, for working professionals. Take a look.
From: Ramy Hashish <ramy.ihashish@gmail.com> Date: Tuesday, 24 July 2018 at 2:33 PM To: "Compton, Rich A" <Rich.Compton@charter.com> Cc: Christopher Morrow <morrowc.lists@gmail.com>, Suresh Ramasubramanian <ops.lists@gmail.com>, nanog list <nanog@nanog.org> Subject: Re: SP security knowledge build up
Thank you Christopher, Compton and Suresh, that was helpful.
I am still looking for more.
Does anyone want to recommend any MOOC?
Thanks,
Ramy
On 23 July 2018 at 17:30, Compton, Rich A <Rich.Compton@charter.com> wrote:
Barry Greene's site has some good info on ISP security as well: http://www.senki.org
On 7/23/18, 8:08 AM, "NANOG on behalf of Christopher Morrow" <nanog-bounces@nanog.org on behalf of morrowc.lists@gmail.com> wrote:
I thought also there was a set of videos from nanog meetings... I can't find a set, but here are some:
ISP Security 101 primer https://www.youtube.com/watch?v=ueRminCpnMc
isp security real-world techniques - 2 https://www.youtube.com/watch?v=Ijd9A5wUS_0 https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?)
ISP Security toolkits https://www.youtube.com/watch?v=w7XcZS_99WQ
NRIC Best Practices for ISP Security https://www.youtube.com/watch?v=1bzL5eUGC-0
there are actually quite a few more, searching for 'security nanog' turned up.
On Mon, Jul 23, 2018 at 9:32 AM Suresh Ramasubramanian <ops.lists@gmail.com> wrote:
The usual / canonical sysadmin book might work, there is a lot of security related material in there as well.
https://www.amazon.com/Practice-System-Network-Administration-Second/ dp/0321492668
And this updated for enterprise / devops and other such new
fangled things
https://www.amazon.com/Practice-System-Network-Administration-Enterpr ise/dp/0321919165/ref=pd_lpo_sbs_14_t_0?_encoding=UTF8&psc=1&refRID=2N4F 09FPM9FG9VQNT433
On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish"
<nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of ramy.ihashish@gmail.com> wrote:
Hello All,
I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with? We are looking forward to building a concrete foundation of a well-rounded security engineer, we are looking for vendor/operator agnostic resources.
Thanks,
Ramy
E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
- -- Douglas C. Stephens | Network Systems Analyst Enterprise Information Services | Phone: (515) 294-6102 Ames Laboratory, US DOE | Email: stephend@ameslab.gov -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) iEUEARECAAYFAltXIs4ACgkQ46phdn656QTvoACgnZ7bbZkoauPAy7F6Ur8YBBBr uNQAmOjWWvjDnZC/tnQP9dkuI0gjHdA= =iG2H -----END PGP SIGNATURE-----
On Mon, Jul 23, 2018 at 03:22:46PM +0200, Ramy Hashish wrote:
I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with?
1. Start with one or more engineers who aren't "fresh". This is more expensive, potentially much more expensive, but it's much more likely to result in success than trying to feed a crash course in security into the brains of people who've never done any of this before. Even if all those experienced people do is stop you from making well-known mistakes, then the investment will be more than worth it. 2. I see that several academic programs were mentioned downthread; one that I'd add to the list is UMBC, which is excellent. ---rsk
On Mon, Jul 23, 2018 at 03:22:46PM +0200, Ramy Hashish wrote:
I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with?
To add to the academic programs - CU Boulder has an excellent telecom program for network security and network engineering; one of their courses focuses solely on SP networks (full disclosure: I am a CU Boulder alumnus). With Gratitude, Pratik Lotia | Security Engineer III Charter Communications -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Rich Kulawiec Sent: Tuesday, July 24, 2018 10:43 AM To: nanog@nanog.org Subject: Re: SP security knowledge build up On Mon, Jul 23, 2018 at 03:22:46PM +0200, Ramy Hashish wrote:
I am planning to build up a security team of fresh engineers whom are "network oriented", any advice on the knowledge resources we can start with?
1. Start with one or more engineers who aren't "fresh". This is more expensive, potentially much more expensive, but it's much more likely to result in success than trying to feed a crash course in security into the brains of people who've never done any of this before. Even if all those experienced people do is stop you from making well-known mistakes, then the investment will be more than worth it. 2. I see that several academic programs were mentioned downthread; one that I'd add to the list is UMBC, which is excellent. ---rsk E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.
participants (8)
-
Christopher Morrow -
Compton, Rich A -
Douglas C. Stephens -
Lotia, Pratik M -
Ramy Hashish -
Rich Kulawiec -
Roland Dobbins -
Suresh Ramasubramanian