SP security knowledge build up

Mailman List Mirror (Read Only)
1

Hello All,

I am planning to build up a security team of fresh engineers whom are
"network oriented", any advice on the knowledge resources we can start
with? We are looking forward to building a concrete foundation of a
well-rounded security engineer, we are looking for vendor/operator agnostic
resources.

Thanks,

Ramy

2

The usual / canonical sysadmin book might work, there is a lot of security related material in there as well.

https://www.amazon.com/Practice-System-Network-Administration-Second/dp/0321492668

And this updated for enterprise / devops and other such new fangled things

https://www.amazon.com/Practice-System-Network-Administration-Enterprise/dp/0321919165/ref=pd_lpo_sbs_14_t_0?_encoding=UTF8&psc=1&refRID=2N4F09FPM9FG9VQNT433

3

I thought also there was a set of videos from nanog meetings...
I can't find a set, but here are some:

ISP Security 101 primer
https://www.youtube.com/watch?v=ueRminCpnMc

isp security real-world techniques - 2
https://www.youtube.com/watch?v=Ijd9A5wUS_0
https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?)

ISP Security toolkits
https://www.youtube.com/watch?v=w7XcZS_99WQ

NRIC Best Practices for ISP Security
https://www.youtube.com/watch?v=1bzL5eUGC-0

there are actually quite a few more, searching for 'security nanog' turned
up.

4

Barry Greene's site has some good info on ISP security as well: http://www.senki.org

    I thought also there was a set of videos from nanog meetings...
    I can't find a set, but here are some:
    
    ISP Security 101 primer
    https://www.youtube.com/watch?v=ueRminCpnMc
    
    isp security real-world techniques - 2
    https://www.youtube.com/watch?v=Ijd9A5wUS_0
    https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of previous?)
    
    ISP Security toolkits
    https://www.youtube.com/watch?v=w7XcZS_99WQ
    
    NRIC Best Practices for ISP Security
    https://www.youtube.com/watch?v=1bzL5eUGC-0
    
    there are actually quite a few more, searching for 'security nanog' turned
    up.

5

Here're some more:

<https://app.box.com/s/4h2l6f4m8is6jnwk28cg>

This book is also highly recommended:

<https://www.amazon.com/Router-Security-Strategies-Networking-Technology-ebook/dp/B0051TM5L2/>

6

Thank you Christopher, Compton and Suresh, that was helpful.

I am still looking for more.

Does anyone want to recommend any MOOC?

Thanks,

Ramy

7

Not a MOOC. But several schools now have graduate programs in security. Off the top of my head, Georgia Tech, UAB, GMU ..

They might offer some shorter courses as well, for working professionals. Take a look.

8

To add to Suresh's list, Iowa State University (iastate.edu) offers a
graduate major program and an undergraduate minor program in cyber
security (a.k.a. Information Assurance). They also run an annual
cyber defense competition (ISEAGE).

Not a MOOC. But several schools now have graduate programs in
security. Off the top of my head, Georgia Tech, UAB, GMU ..

They might offer some shorter courses as well, for working
professionals. Take a look.

From: Ramy Hashish <ramy.ihashish@gmail.com> Date: Tuesday, 24
July 2018 at 2:33 PM To: "Compton, Rich A"
<Rich.Compton@charter.com> Cc: Christopher Morrow
<morrowc.lists@gmail.com>, Suresh Ramasubramanian
<ops.lists@gmail.com>, nanog list <nanog@nanog.org> Subject: Re: SP
security knowledge build up

Thank you Christopher, Compton and Suresh, that was helpful.

I am still looking for more.

Does anyone want to recommend any MOOC?

Thanks,

Ramy

Barry Greene's site has some good info on ISP security as well:
http://www.senki.org

On 7/23/18, 8:08 AM, "NANOG on behalf of Christopher Morrow"
<nanog-bounces@nanog.org on behalf of morrowc.lists@gmail.com>
wrote:

I thought also there was a set of videos from nanog meetings... I
can't find a set, but here are some:

ISP Security 101 primer
https://www.youtube.com/watch?v=ueRminCpnMc

isp security real-world techniques - 2
https://www.youtube.com/watch?v=Ijd9A5wUS_0
https://www.youtube.com/watch?v=T6ZSxgVvjdA (older version of
previous?)

ISP Security toolkits https://www.youtube.com/watch?v=w7XcZS_99WQ

NRIC Best Practices for ISP Security
https://www.youtube.com/watch?v=1bzL5eUGC-0

there are actually quite a few more, searching for 'security
nanog' turned up.

The usual / canonical sysadmin book might work, there is a lot
of security related material in there as well.

https://www.amazon.com/Practice-System-Network-Administration-Second/

dp/0321492668

And this updated for enterprise / devops and other such new

fangled things

https://www.amazon.com/Practice-System-Network-Administration-Enterpr

ise/dp/0321919165/ref=pd_lpo_sbs_14_t_0?_encoding=UTF8&psc=1&refRID=2N4F
09FPM9FG9VQNT433

On 23/07/18, 6:55 PM, "NANOG on behalf of Ramy Hashish"

<nanog-bounces+ops.lists=gmail.com@nanog.org on behalf of

Hello All,

I am planning to build up a security team of fresh engineers
whom are "network oriented", any advice on the knowledge
resources we can start with? We are looking forward to building a
concrete foundation of a well-rounded security engineer, we are
looking for vendor/operator agnostic resources.

Thanks,

Ramy

E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message
and any attachments are intended solely for the addressee(s) and
may contain confidential and/or legally privileged information. If
you are not the intended recipient of this message or if this
message has been addressed to you in error, please immediately
alert the sender by reply e-mail and then delete this message and
any attachments. If you are not the intended recipient, you are
notified that any use, dissemination, distribution, copying, or
storage of this message or any attachment is strictly prohibited.

- --
Douglas C. Stephens | Network Systems Analyst
Enterprise Information Services | Phone: (515) 294-6102
Ames Laboratory, US DOE | Email: stephend@ameslab.gov

9

1. Start with one or more engineers who aren't "fresh". This is more
expensive, potentially much more expensive, but it's much more likely
to result in success than trying to feed a crash course in security
into the brains of people who've never done any of this before. Even if all
those experienced people do is stop you from making well-known mistakes,
then the investment will be more than worth it.

2. I see that several academic programs were mentioned downthread;
one that I'd add to the list is UMBC, which is excellent.

---rsk

10

I am planning to build up a security team of fresh engineers whom are
"network oriented", any advice on the knowledge resources we can start
with?

To add to the academic programs -

CU Boulder has an excellent telecom program for network security and network engineering; one of their courses focuses solely on SP networks (full disclosure: I am a CU Boulder alumnus).

With Gratitude,

Pratik Lotia | Security Engineer III
Charter Communications