Can you learn security in the classroom?

If you have an active interest in learning security, you can find tidbits everywhere. I had an AIX teacher that was a seasoned sysadmin. I learned a lot from his tales of dealing with tracking down naughty people and dealing with police investigations, and how those things changed the way he did business. I also learn from online discussions, magazines, usenet, and other techs.

Basic concepts can definitely be taught in the classroom, and real world examples help to make the concepts more real to the students. Almost everyone enjoys anecdotes that have real application, and it helps cement the often dry concepts of security methods.

"The real goal should be to design applications around security, not improve the security of programs that are already full of holes."

While that is sensible, even commendable thinking, what about the security quagmire that we are forced to wade through now? Sure it will be nice to know that future applications coming onstream will not add additional problems to the list, but something that protects against todays problems will likely also do the same for future problems as well.

Many of todays security breaches are the results of not even basic precautions being taken when known remedies for vulnerablities are known and available, for reasons of overwork, complacency and pure lazyness. It is unfortunate that those proactive and alert admins who make the effort are still often vulnerable to some degree.

You could train all the programmers in the world best security practices, but is that their #1 concern when they are racing a deadline to release software?

Unfortunately, security is barely an afterthought as the boxes ship.

Since the software always comes with the standard "don't blame us no matter what" disclosure, do they even have to care? Do they just "hope" that the software flaws they have will be discovered and reported to them by a friendly source?

The sad part is, which wasn't addressed in this article, is that since the programmers and company take little to no responsibility to their product, all the training or real life experience in the world won't help if they don't care. And in the end once you've bought the product they've gotten what they set out to do, didn't they? Sell product?

And if there are flaws, that just paves the way for the next x.0 release of their product - with improved security and a few more features, and more cash in their pockets.

The lesson to be learned from Microsoft isn't that it pays to have good code, it's that it pays to NOT have good code - and just sell the security with the bug fixes and upgrades later on once the programmers "get around" to that part.

Class dismissed.

I agree: Security savvy is not learned in the classroom. Like many other important lessons of experience, security is little understood in academia. Schools are usually behind the technical curve anyway;we must develop our expertise independent of our university educations. Some of the best information I have is in books about hacking. The rest of the good knowledge comes from networking and practice. Just like medicine, another highly technical field that's an art form when practiced well.
Susan McKinney

I can't add much to the excellent advice given already, except that learning *anything* in I/S - HTML, programming languages, apps, operating system peculiarities - and not just security - takes hands-on experience. So build yourself a little network at home and start hacking away.

I mean, you could theoretically learn how to put up drywall from a Web site like you can learn about security, but until you get some dust up your nose and your hands dirty, you don't REALLY learn how to do it right.

Yes you can learn security in the classroom. Classroom settings should be used for security basics and ongoing security awareness training. Not every company can afford to have the level of internal training necessary to produce knowledgeable security staff. With new areas of security branching, security staff needs to be kept up-to-date, and sometimes a classroom setting is the best way to do it.
Definately more in depth security training would be better relegated to other areas, but at least an overview of topics like secure software coding can be taught in a classroom, then the attendees should continue from there.

You have to start somewhere.

After all there are not too many companies who are willing to hire programmers with out qualifications are there? But by the same token there are many competing interests involved in this area the number one is first make it work then sell it then maybe patch the holes latter.

While there is no simple solution here I do think that Jonathan is correct in saying that security should be a "CORE" subject of any computer sciences course but even then it will only provide the building blocks with which these students can then start to learn what they have spent all that time training for. But on the other hand Universities tend to teach tunnel vision and only one way to do things when there are in fact several different ways of achieving the same thing but this all boils down to the teachers which is something that is out of your control as even the most gifted teacher has their bad days and eventually burn out so someone who may have been brilliant 10 years ago as a teacher could very well be on their way out right now and not providing the best available information or similarly they might just not know about the latest security ideas as they have been far too long away from the actual work and are only going on theory rather than solid piratical experience.

While there is a very real need for education it should only ever be considered as the right to start to learn what you have spent those years training for rather than the idea that you know it all when you leave the Uni and will only go downhill from there as you get further away from the academic experience.

Col

So, to summarize what I get from the discussion, good classes can teach you well-known historical security issues, and and help you begin to develop the knack for creative thinking to anticipate and adapt to new kinds of attacks.

It's like that for advanced math and physics degrees (and some profs try to do it with newbies). There are lots of folks who learn the well-worn paths, and a rare few who pick up what's needed to create new paths out from the frontier.

I agree with most of the discussion but at the same time believe that security basics can be learnt in a classroom - however security should be the foundation of all computer science and technical training classes so that when one graduates it becomes second nature/habit. This needs to happen if we are going to have an almost secure system. As some one earlier mentioned - there is no such thing as 100% secure! As long as new technologies emerge, rebirth of old technology occurs along with outsourcing of code, call centres to save a buck or two then these challenges will keep surfacing its ugly heads. I don't see outsourcing disappearing any time soon - so what is the alternative? Educating IT people to be security concious and developing skills that automatically check/test for quality of security.

With the number of applications in a given environment on the rise - just closing ports does not always work - for instance with videoconferencing where applications use dynamic ports or a range of ports, the network begins start opening up (firewalls). With introduction of another application - few more ports need to be opened - before you know it - almost all the ports are open! So carful planning and if necessary redisigning of the network may be necessary to accomodate new technologies!

Having just taken a security course at the graduate level I would say you cannot learn security in the classroom. First the scope of coverage for the corse is determined by a professor, who in our case had not been working in the field for over ten years.

Second many of my peers didnt understand the majority of the concepts presented... and the professor didnt have the time to answer all the questions the students had to ask. Yet even the slowest student passed the class with a C.

All the relevant security information I've learned has come from self study. Its impossible to stay abrest of the newest technologies without taking this route.

I've only been in the field for four years now but I know many area Administrators. We hit each others systems for known security vounerabilites and do our best to bring our systems down. Its a high cost but a necessary one.

I believe it is only in this context that you can learn to apply the concepts of security to a real world environment.

Having just taken a security course at the graduate level I would say you cannot learn security in the classroom. First the scope of coverage for the corse is determined by a professor, who in our case had not been working in the field for over ten years.

Second many of my peers didnt understand the majority of the concepts presented... and the professor didnt have the time to answer all the questions the students had to ask. Yet even the slowest student passed the class with a C.

All the relevant security information I've learned has come from self study. Its impossible to stay abrest of the newest technologies without taking this route.

I've only been in the field for four years now but I know many area Administrators. We hit each others systems for known security vounerabilites and do our best to bring our systems down. Its a high cost but a necessary one.

I believe it is only in this context that you can learn to apply the concepts of security to a real world environment.