Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an introduction to security, and toward IT professionals who have recently been tasked with securing a network.

The idea is to create a book that covers the most vital and important parts of securing a network with no assumptions. So, if you were a novice student interested in network security OR an IT professional who needed a crash course on network security, what topics do you feel would be of the upmost importance in such a text?


migration rejected from Jan 12 at 13:23

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as primarily opinion-based by HopelessN00b Jan 12 at 13:23

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

@skaffman - thanks for the tag add –  sethvargo Jan 9 '11 at 21:58
Why not have a look at some of the 10 gazillion other books on the subject and see what's normally covered? Yes, the subject has been well covered already. –  John Gardeniers Jan 10 '11 at 1:34
@John Gardeniers - because I want people's opinions. I know what's covered, I want to hear what professionals think is important. Just because certain things currently exist in textbooks doesn't mean its the best material –  sethvargo Jan 10 '11 at 2:15

1 Answer 1

Here's my own list of topics that I see people keep failing at, frequently:

  • How to use crypto
  • When NOT to use crypto
  • Authentication != Authorization
  • Not understanding TCP/IP suite, especially the layering, fragmentation and reassembly
  • How to do security not compliance, and how to deal when they're at odds
  • Understanding where do problems come from, and what do mitigations really do
  • Compromising security for the sake of comfort/ignorance (e.g. installing full Xorg and desktop managers so they can add a user)
  • Protocol analysis (why is MD4 fine by itself, but WEP is horribly broken despite being built on top of MD4)
  • Distinguishing between different classes of attacks and what mechanism is being faulty/misused
  • Understanding the difference between bad design and bad implementation, and the consequences of both
  • Understanding various security mechanisms and what they really try to prevent (e.g. by now firewalls are a mindless requirement, but can most people name what type of security problem they solve?)
  • Debugging network problems--localizing the problem to software/hardware, your machine vs other machines vs network
  • Learning the difference between a solution, a mitigation, and an obscure obstacle
+1 for authentication != authorization –  sethvargo Jan 17 '11 at 15:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.