DOCSLIB.ORG

Secrets to Landing Your Next Information Security Job

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Secrets to Landing Your Next Information Security Job IT Security Interviews Exposed Secrets to Landing Your Next Information Security Job Chris Butler Russ Rogers Mason Ferratt Greg Miles Ed Fuller Chris Hurley Rob Cameron Brian Kirouac Wiley Publishing, Inc. 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page ii 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page i IT Security Interviews Exposed 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page ii 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page iii IT Security Interviews Exposed Secrets to Landing Your Next Information Security Job Chris Butler Russ Rogers Mason Ferratt Greg Miles Ed Fuller Chris Hurley Rob Cameron Brian Kirouac Wiley Publishing, Inc. 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page iv IT Security Interviews Exposed: Secrets to Landing Your Next Information Security Job Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2007 by Chris Butler Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-471-77987-2 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data IT security interviews exposed : secrets to landing your next information security job / Christopher Butler ... [et al.]. p. cm. ISBN 978-0-471-77987-2 (pbk.) 1. Information technology — Vocational guidance. 2. Computer security. I. Butler, Christopher. T58.5.I836 2007 005.8023 — dc22 2007018923 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permis- sion of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley .com/go/permissions. Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or war- ranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Website may provide or recommendations it may make. Further, readers should be aware that Internet Websites listed in this work may have changed or disappeared between when this work was written and when it is read. For general information on our other products and services please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Trademarks: Wiley, the Wiley logo, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used with- out written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page v I dedicate this book to my two oldest children: Ariel and Erie. Thanks for everything. — Dad (Chris Butler) 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page vi 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page vii About the Authors Chris Butler (CISSP, JNCIS-FWV, JNCIA-SSL, CCSE, IAM/IEM) is a Senior Solutions Architect with Intellitactics. Chris has more than a dozen years of experience in the networking and security fields. He is a veteran of the United States Navy, where he worked in the cryptography field. Chris has designed, implemented, and supported some of the largest networks in the country for large insurance companies, investment firms, software companies, service providers, and pharmaceutical companies. He has also provided network and security consulting services for numerous U.S. government agencies, including the Department of State, Department of Defense, and the Department of Energy. He has worked exten- sively with the leading security and networking vendors throughout his career. He is also well versed in both commercial and open source network and security management software. Chris has also performed in-depth application analysis and network modeling using OPNET software for dozens of large compa- nies. He is a member of the IEEE Computer Society and SANS. Russ Rogers (CISSP, IAM/IEM) is a Senior Cyber Security Analyst and the former CEO and co-founder of Security Horizon, Inc. Russ is a United States Air Force veteran and has served in military and con- tract support for the National Security Agency, Defense Information Systems Agency, and the other federal agencies. He is also the editor-in-chief of The Security Journal. Additionally, he serves as the Professor of Network Security at the University of Advancing Technology (uat.edu) in Tempe, Arizona. Russ is the author, co-author, or technical editor for nearly a dozen books on information security. Russ has spoken and provided training to audiences around the world and is also a co-founder of the Security Tribe information security research Web site at www.securitytribe.com. His education includes a bachelor’s and master’s degree from the University of Maryland in Computer Science areas. Mason Ferratt (JNCIS-FWV, JNCIA-M MSEE, BSME) is a Federal Systems Engineer with Juniper Networks in Charleston, South Carolina. He has performed large-scale network security engineering for numerous government clients. His most recent work involves the Department of Defense medical community, where his team is responsible for the security posture of all Navy and Army hospitals and clinics in the world. His specialty is in purpose-built intrusion detection/protection, VPN encryption, firewall, content filter- ing, and secure remote access devices. His prior jobs include network engineering design, modeling, and testing for the Department of State, and pre- and post-sales network engineering for several optical/WAN vendors (Corvis Corporation, Corrigent Systems, Lucent Technologies, Ascend Communications, and Network Equipment Technologies). He holds a Master of Science degree in Electrical Engineering from George Washington University, and a Bachelor of Science degree in Mechanical Engineering from the University of Virginia. He holds a Top Secret/SCI clearance and is an IEEE member. Greg Miles (CISSP, CISM, IAM/IEM) is a co-founder, President, Chief Financial Officer, and Principal Security Consultant for Security Horizon, Inc., a Colorado-based professional security services and train- ing provider and veteran-owned small business. He is a United States Air Force veteran and has served in military and contract support for the National Security Agency, Defense Information Systems Agency, Air Force Space Command, and NASA supporting worldwide security efforts. Greg has planned and managed Computer Incident Response Teams (CIRTs), Computer Forensics, and INFOSEC training capa- bilities. Greg has been published in multiple periodicals, including The Security Journal and The International Journal on Cyber Crime. He co-authored Network Security Evaluation: Using the NSA IEM (Syngress. ISBN: 978-1597490351) and Security Assessment: Case Studies for Implementing the NSA IAM (Syngress. ISBN: 978- 1932266962). Greg is a network security instructor for the University of Advancing Technology (UAT) and an advisor with Colorado Technical University (CTU). 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page viii Ed Fuller (CISSP, IAM/IEM) is Senior Vice President, COO, and Principal Security Consultant for Security Horizon, Inc. He has more than 28 years of experience in operations, communications, computer informa- tion systems, and security. He is the primary lead for INFOSEC Assessments and Training for Security Horizon. Ed has served as team lead for INFOSEC assessments for more than nine years. He has served other companies as an INFOSEC Training Manager and Senior Security Consultant. Ed was integrally involved in establishing, implementing, and supporting the worldwide security program for the Defense Information Systems Agency (DISA), directly supporting Field Security Operations (FSO). He was a par- ticipant in the development of the Systems Security Engineering Capability Maturity Model (SSE-CMM) and has been a key individual in the development and maintenance of the Information Assurance Capability Maturity Model (IA-CMM). Ed also serves as a Lead Instructor for the National Security Agency (NSA) INFOSEC Assessment Methodology (IAM) and the INFOSEC Evaluation Methodology (IEM). Ed retired from the United States Navy with more than 23 years of distinguished service. Ed is a co-author for Security Assessment: Case Studies for Implementing the NSA IAM (Syngress. ISBN: 978-1932266962) and Network Security Evaluation: Using the NSA IEM (Syngress. ISBN: 978-1597490351) and a frequent contributer for the The Security Journal, a quarterly security periodical. Chris Hurley (IAM/IEM) is a senior penetration tester working in the Washington, D.C.
Load more

Recommended publications
  • Advanced Cyber Security Techniques (PGDCS-08)
    Post-Graduate Diploma in Cyber Security Advanced Cyber Security Techniques (PGDCS-08) Title Advanced Cyber Security Techniques Advisors Mr. R. Thyagarajan, Head, Admn. & Finance and Acting Director, CEMCA Dr. Manas Ranjan Panigrahi, Program Officer (Education), CEMCA Prof. Durgesh Pant, Director-SCS&IT, UOU Editor Mr. Manish Koranga, Senior Consultant, Wipro Technologies, Bangalore Authors Block I> Unit I, Unit II, Unit III & Unit Mr. Ashutosh Bahuguna, Scientist- Indian IV Computer Emergency Response Team (CERT-In), Department of Electronics & IT, Ministry of Communication & IT, Government of India Block II> Unit I, Unit II, Unit III & Unit Mr. Sani Abhilash, Scientist- Indian IV Computer Emergency Response Team Block III> Unit I, Unit II, Unit III & Unit (CERT-In), Department of Electronics & IT, IV Ministry of Communication & IT, Government of India ISBN: 978-93-84813-95-6 Acknowledgement The University acknowledges with thanks the expertise and financial support provided by Commonwealth Educational Media Centre for Asia (CEMCA), New Delhi, for the preparation of this study material. Uttarakhand Open University, 2016 © Uttarakhand Open University, 2016. Advanced Cyber Security Techniques is made available under a Creative Commons Attribution Share-Alike 4.0 Licence (international): http://creativecommons.org/licenses/by-sa/4.0/ It is attributed to the sources marked in the References, Article Sources and Contributors section. Published by: Uttarakhand Open University, Haldwani Expert Panel S. No. Name 1 Dr. Jeetendra Pande, School of Computer Science & IT, Uttarakhand Open University, Haldwani 2 Prof. Ashok Panjwani, Professor, MDI, Gurgoan 3 Group Captain Ashok Katariya, Ministry of Defense, New Delhi 4 Mr. Ashutosh Bahuguna, Scientist-CERT-In, Department of Electronics & Information Technology, Government of India 5 Mr.
    [Show full text]
  • Advanced Cyber Security Techniques (PGDCS-07)
    Post-Graduate Diploma in Cyber Security Advanced Cyber Security Techniques (PGDCS-07) Title Advanced Cyber Security Techniques Advisors(CEMCA) Mr. R. Thyagarajan, Head, Admn. & Finance and Acting Director, CEMCA Dr. Manas Ranjan Panigrahi, Program Officer(Education), CEMCA Editor Mr. Manish Koranga, Senior Consultant, Wipro Technologies, Bangalore Block I> Unit I, Unit II, Unit III & Unit Mr. Ashutosh Bahuguna, Scientist- Indian IV Computer Emergency Response Team (CERT-In), Department of Electronics & IT, Ministry of Communication & IT, Government of India Block II> Unit I, Unit II, Unit III & Unit Mr. Sani Abhilash, Scientist- Indian IV Computer Emergency Response Team Block III> Unit I, Unit II, Unit III & Unit (CERT-In), Department of Electronics & IT, IV Ministry of Communication & IT, Government of India ISBN: 978-93-84813-95-6 Acknowledgement The University acknowledges with thanks the expertise and financial support provided by Commonwealth Educational Media Centre for Asia(CEMCA), New Delhi, for the preparation of this study material. Uttarakhand Open University, 2016 © Uttarakhand Open University, 2016. Advanced Cyber Security Techniques is made available under a Creative Commons Attribution Share-Alike 4.0 Licence (international): http://creativecommons.org/licenses/by-sa/4.0/ It is attributed to the sources marked in the References, Article Sources and Contributors section. Published by: Uttarakhand Open University INDEX BLOCK I .................................................................................................................................
    [Show full text]
  • IT Security Interviews Exposed Secrets to Landing Your Next Information Security Job
    79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page iii IT Security Interviews Exposed Secrets to Landing Your Next Information Security Job Chris Butler Russ Rogers Mason Ferratt Greg Miles Ed Fuller Chris Hurley Rob Cameron Brian Kirouac Wiley Publishing, Inc. 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page ii 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page i IT Security Interviews Exposed 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page ii 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page iii IT Security Interviews Exposed Secrets to Landing Your Next Information Security Job Chris Butler Russ Rogers Mason Ferratt Greg Miles Ed Fuller Chris Hurley Rob Cameron Brian Kirouac Wiley Publishing, Inc. 79872ffirs.qxd:WroxPro 6/12/07 3:54 PM Page iv IT Security Interviews Exposed: Secrets to Landing Your Next Information Security Job Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2007 by Chris Butler Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-471-77987-2 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data IT security interviews exposed : secrets to landing your next information security job / Christopher Butler ... [et al.]. p. cm. ISBN 978-0-471-77987-2 (pbk.) 1. Information technology — Vocational guidance. 2. Computer security. I. Butler, Christopher. T58.5.I836 2007 005.8023 — dc22 2007018923 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permis- sion of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600.
    [Show full text]
  • Information Systems Security Assessment Framework (ISSAF) Draft 0.2
    Information Systems Security Assessment Framework (ISSAF) draft 0.2 TABLE OF CONTENTS 1 EXECUTIVE SUMMARY .........................................................................................................12 A PENETRATION TESTING METHODOLOGY .....................................................................13 B PENETRATION TESTING METHODOLOGY, PHASE-II EXPLAINED.........................25 C HANDLING FALSE DETECTION RATES ..........................................................................170 -- NETWORK SECURITY................................................................................................................173 D PASSWORD SECURITY TESTING ......................................................................................174 E SWITCH SECURITY ASSESSMENT....................................................................................240 F ROUTER SECURITY ASSESSMENT ...................................................................................275 G FIREWALL SECURITY ASSESSMENT...............................................................................318 H INTRUSION DETECTION SYSTEM SECURITY ASSESSMENT....................................366 I VPN SECURITY ASSESSMENT ............................................................................................389 J ANTI-VIRUS SYSTEM SECURITY ASSESSMENT AND MANAGEMENT STRATEGY 399 K STORAGE AREA NETWORK (SAN) SECURITY ..............................................................413 L WLAN SECURITY ASSESSMENT........................................................................................423
    [Show full text]
  • Hacking Wireless Networks for Dummies‰
    01_597302 _ffirs.qxd 8/4/05 7:08 PM Page i Hacking Wireless Networks FOR DUMmIES‰ by Kevin Beaver and Peter T.Davis Foreword by Devin K. Akin Chief Technology Officer, The Certified Wireless Network Professional (CWNP) Program 01_597302 _ffirs.qxd 8/4/05 7:08 PM Page i 01_597302 _ffirs.qxd 8/4/05 7:08 PM Page i Hacking Wireless Networks FOR DUMmIES‰ by Kevin Beaver and Peter T.Davis Foreword by Devin K. Akin Chief Technology Officer, The Certified Wireless Network Professional (CWNP) Program 01_597302 _ffirs.qxd 8/4/05 7:08 PM Page ii Hacking Wireless Networks For Dummies® Published by Wiley Publishing, Inc. 111 River Street Hoboken, NJ 07030-5774 www.wiley.com Copyright © 2005 by Wiley Publishing, Inc., Indianapolis, Indiana Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permit- ted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions. Trademarks: Wiley, the Wiley Publishing logo, For Dummies, the Dummies Man logo, A Reference for the Rest of Us!, The Dummies Way, Dummies Daily, The Fun and Easy Way, Dummies.com, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc.
    [Show full text]
  • Scapy Documentation Release 2.4.5
    Scapy Documentation Release 2.4.5. Philippe Biondi and the Scapy community Sep 28, 2021 GENERAL DOCUMENTATION 1 Introduction 3 1.1 About Scapy........................................3 1.2 What makes Scapy so special...............................4 1.3 Quick demo.........................................5 1.4 Learning Python......................................7 2 Download and Installation9 2.1 Overview..........................................9 2.2 Scapy versions.......................................9 2.3 Installing Scapy v2.x....................................9 2.4 Optional Dependencies................................... 11 2.5 Platform-specific instructions............................... 12 2.6 Build the documentation offline.............................. 16 3 Usage 17 3.1 Starting Scapy....................................... 17 3.2 Interactive tutorial..................................... 18 3.3 Simple one-liners...................................... 47 3.4 Recipes........................................... 53 4 Advanced usage 59 4.1 ASN.1 and SNMP..................................... 59 4.2 Automata.......................................... 71 4.3 PipeTools.......................................... 79 5 Scapy routing 87 5.1 List interfaces....................................... 87 5.2 IPv4 routes......................................... 87 5.3 IPv6 routes......................................... 88 5.4 Get router IP address.................................... 88 5.5 Get local IP / IP of an interface.............................
    [Show full text]