Thursday, June 30, 2011

TCP/IP Skills Required for Security Analysts

This is an interesting article over at Symantec Connect by a Intrusion Detection Specialist names Don Parker. It coveres what the basics are to be a thorough Security Analyst. It's a 2 part article with the first part of the article covers Parker's thoughts on the skills required, then the second installment gives insight into a day in the life of an Analyst. Have a read --

Comptia Certification Roadmap

Comptia has put out a interactive roadmap for career paths and certifications. Its interesting to see Comptia's perspective on the IT world and where they places themselves. As of late Ive come under the impression that Comptia has a great marketing team and from what I've read they are DoD required for certian positions.Check it out: Comptia cert roadmap

Wednesday, June 29, 2011

Infosec jobs and descriptions

This post on is one of the better explanations of infosec work and process that I have seen. It was posted by keatron, an Infosec professional and trainer. His company, Infosec Institute can be found here: and the post in question can be found here: Its a great read as are a good number of his other posts.

Heres a snippet
"...IDS specialist, firewall specialist, penetration tester, forensics investigator, security assessments (not to be confused with penetration testing because they are different), just to name a few. Most people hear the term Infosec, and they automatically associate that with network and telecom security, but in reality it's much broader than that. I know people who do nothing but design and test physical security, they break biometric mechanisms, social engineer the heck outta people, and do tons of other things that require little or no knowledge of network or telecom security. The fact is, in most small and medium sized companies, the security team usually consists of one person (if they have that much)..."

Scott Morris, CCIE 4x, JNCIS-M, etc. talks Subnetting IPv4 / IPv6

This is a great subnetting by binary (and IPv6) lecture by Scott Morris, have a look here. Its well worth the watch and coupled with Odom's take of subnetting its a great foundation. Besides, binary is is pretty easy and impresses your friends!

what is the first usable host of the IP address

This is a post I did on about subnetting. I wanted it here for reference.

You've got two way to look at it 0., Binary and 1., Magic. <-- see that binary humor?!?

Ok, your question is
what is the first usable host of the IP address

we'll look at 3 different kinds of bits,
N=network bits
S = subnet bits
H= host bits is a class C address which means the first 3 of the 4 sets of 8 bit blocks called octets, are N blocks (Class A = first octet, class B = first two octets, class C = first three octets - are network). like:

thats says the 212.46.165 is the network portion of the address. So the rest is devided up into S bits and H bits. Lets look at that CIDR number again, /25. So the first 3 blocks, our network blocks are /24 (count the Ns in the above class C example). That means we have 1 extra bit to be placed in our network bits, but its beyond the class C first 3 blocks so it ends up being a subnet bit like so
nnnnnnnn.nnnnnnnn.nnnnnnnn.s <--/25 where /24 is the n bits and /1 is the subnet bit

The rest of our bits are then host bits. So IPv4 is a total of 32 bits. We have 24 N bits, 1 S bit, and that leaves us with 7 bits. Those last bits are then H bits which makes the IP effectively look like this:

We can then take those H bits and drop them into the equation
2^H= number of hosts per subnet (we can also do 2^s but well save that for later)

We have 7 H bits which gives us, 2^7 = 128

So for each subnet in the address there is 128 hosts. So lets count by 128s <-- first subnet <-- second (and last) subnet

For usable hosts, we need to take out the broadcast and network address' (first and last address) <--network address <-- first usable host <-- last usable host <-- broadcast

Whew! On to magic!
Again, we look at the CIDR notation /25. If we count up the first 3 octects are 24 bits which means /25 lands us at the first bit in the 4th octet.
----------------------------- ^
first bit last octet

So that 1st bit in the last octet, that points to our magic number. If we look at an octet, its powers of 2,

128 64 32 16 8 4 2 1

if we take that 1 bit left over (25-24=1) then we can drop that bit in the first place on the left side, the 128th place.

128 64 32 16 8 4 2 1

So that left over 1 is telling us that the magic number is 128. So, to figure the subnets we count by 128.
0 128
In our questioned address, it would look like so, <--subnet 1 <-- subnet 2 -- it stops here (because 2^8=256 thus an octet can only handle 256).

So the address falls into the host range -

But as you know, we need to take out the broadcast and subnet addresses in order to get our usable hosts, thus the usable host range is -

Great subnetting by binary (and IPv6) lecture here. Also, great practice here.

Honeypot Challenge

While reading a thread on a fellow TE user (docrice) posted a note about giving the honeypot challenges a try for people interested in a career in infosec. Its a pretty nifty site and post CCNA studies I think I'm going to give a challenge a shot and see if its really where I want to land eventually.

Their mission statement:
"To learn the tools, tactics and motives involved in computer and network attacks, and share the lessons learned."

In information security a honeypot is a trap (e.g., a faux server) with fake information stored on it. Its place is to bate hackers into attacking it and give them useless information while being able to gather information on the attack.

From wikipedia:
"In computer terminology, a honeypot is a trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. Generally it consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers."

Currently working on the CCNA

For the past year Ive been working on the Cisco Certified Network Associate certification (CCNA). Ive attended and completed the Cisco Networking Academy and am now on to the final months prior to taking the certification exam. This to be the first of many to come or so the plan goes. The best laid plans of Mice and Men, right?

So, this blog is to keep a log of the information I put together as I am not just collecting it from one source. Rather, I often find that answers and information regarding something like questions on the OSPF routing protocol come from many different sources (e.g., Wendel Odom's Official Exam Certification guide,,, Cisco learning net, etc.). So this is where Im compiling them all.  Hopefully it will not only allow me to compile my thoughts and resources, but possibly help others on their journey as well. We shall see.