Great Circle Associates Firewalls
(February 1998)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Certifiying Security Auditors
From: Henry Hertz Hobbit <hhhobbit @ icarus . weber . edu>
Date: Thu, 19 Feb 1998 14:06:02 -0700 (MST)
To: Roger Books <books @ mail . state . fl . us>
Cc: firewalls @ greatcircle . com
In-reply-to: <ML-2 . 2 . 887901844 . 9124 . books @ booksr>

On Thu, 19 Feb 1998, Roger Books wrote:

> > What this points to, is the simple fact that the traditional form of 
> > education system is broken, and needs to be shaken up a little.  This is 
> > not meant as a dig to our esteemed houses of higher learning, but what is 
> > being taught in many colleges today is a total waste to the poor kid who 
> > goes through their program, comes out with a degree, only to find they have
> >  no marketable skills.  Until we educate the educators, this is not going
> > to  change much.
> 
> I have a friend (an MA in history) who would claim that your expectations
> of college are broken.  50 years ago a college was a place where you came
> to expand your mind, make you a better citizen, and maybe a more worthwhile
> person.  If you wanted "marketable skills" you went into a trade school
> or learned by apprenticeship.  Even those that went to college went into
> low-mid management where the ability to think was what was being hired.

What does he claim it is today? Since I am teaching a Computer
Science class (Advanced Programming in the Unix Environment),
here is what I have observed:

1. Most students seem to believe they are some sort of passive
   vessels that we put the funnel in the top of their head and
   pour the knowledge in. It doesn't work that way now, and it
   didn't work that way 50 years ago either. Learning is an
   active process.

2. Despite the simplicity of the assignments I am giving, most
   of the students DON'T get them done on time, and some of them
   are more than a week late! This is the norm for students today.
   At least it is if you talk to the other instructors.

3. Having worked in industry for several years, I can only wonder
   what the students think they are doing. Hells bells, If you can
   them to even think for a few minutes, you have succeeded!
   Forget about them handling anything as complex as they are
   supposed to handle.

> > It really is disheartening to see some of the new graduates coming
> > out of school these days.  I even ran across a Computer Science
> > major, who couldn't load Windows NT from a CD-ROM, nor download
> > a patch if their life depended on it. It really isn't all their
> > fault either... I think they were sold a bill of goods.
> 
> Can you say "Unix"?  Since when does a programmer need to know how
> to load Windows NT?  Does an author need to be able to make a pencil?

No, an author doesn't need to know how to make a pencil, but if you
were being interviewed to work for me as a programmer, if you couldn't
load both FreeBSD (sorry can't assume they have the luxury of doing
an install of Solaris on a Sun, etc.) AND Windows-NT, I DON'T WANT
YOU TO WORK FOR ME! I also expect them to be wise enough to find
an editor that runs on all the platforms (elvis/vi or gmacs come to
mind) that they work on. In other words, the students of today not
only need to learn what is being taught in the class, they also need
to do the following:

1. Learn as much as possible in the areas of Computer Science as
   they are interested in. This means they have to go way above
   the level demanded by a class. Most of them have a problem of
   even doing the material for a class, no matter how simple it
   is.
2. At a minimum, have a modicum of experience in the following
   areas (note, we are talking about Computer Scientists here,
   not History majors):

	[a] Networking - a minimum knowledge of what a router,
	    a bridge, a hub, and at *least* one networking
	    protocol suite (IP?) are. Also helpful would be
	    some knowledge about ATM.
	[b] Knowledgable in a minimum of the following languages
	    Ada, C, C++, Java, HTML, SQL, and some sort of assembler.
	    Note that I said this is the minimum. Ada may have died
	    here, but I notice the UK and Francais jobs frequently
	    want this kind of experience. You never know where you
	    will end up these days...
	[c] Enough knowledge to pick the shell of their choosing
	    on Unix (bash, sh, ksh, tcsh, csh, etc.) and modify
	    the startup scripts to suit their taste SAFELY. Do
	    NOT assume they have this knowledge. For example,
	    I expect them to NOT be so dumb as to put the magic
	    words "tcsh" in their .cshrc file with their login
	    shell being csh, rather than request the System
	    Admininstrator change their default login shell
	    (anybody for making it tcsh for all those doskey/VMS
	    type kids from the start?). If you don't know what
	    putting those magic words in does (assuming you have
	    default csh and the tcsh available of course), try it!
	    You'll like it!
	[d] Know how to install FreeBSD/NetBSD, Windows-95, LINUX,
	    and Windows-NT on an Intel box. This is being posted
	    to the firewalls group, correct? Hmm, it seems that
	    only ONE of the OS's mentioned is not used for this
	    purpose (at least I haven't heard of Win-95 being
	    used this way yet). I am also assuming that only a
	    a few will be blessed with the opportunity of installing
	    Solaris, VM/CSE, etc, despite the fact that many will
	    be doing that in the workplace.
	[e] Pick their favorite Web Browser and configure it;
	    I also think that at a minimum, most schools today
	    should make it possible for students to send email
	    encrypted, just so they know that this is how it
	    is frequently done in the real world.

Now, I am sure that the above can easily be implemented into all
of the classes in *THEORY* that seem to be so essential for any
CS department. For some reason, despite all the talk of OBJECT
oriented code, I see tons of kids that write in C++ in a NON
OBJECT oriented manner. They may as well start with C, the way
they write code - and no, I disagree with the hypothesis that
C code has gone away completely. For that matter, assembler STILL
is being used for device drivers.

> Of course we can't even teach people to trim the excess off of
> their posts, so we may be out of luck.

Sorry, but the following disclaimer must be tacked on. With all
the hackers there are out there now, do you honestly think I have
time to write all of the above drivel?


The Hobbit (not netcat one)

This message can't possibly have come from me! smrsh is not running
so it *must* have come from somebody else going into the smtp port!!!


Follow-Ups:
References:
Indexed By Date Previous: Re: Remote access: Dinamic IP assignment
From: "Daniel \"Cheez\" Brown" <cheez @ cheez . lowprofile . net>
Next: TalkPower.com - Power Utility Discussion Board
From: info @ talkpower . com
Indexed By Thread Previous: Re: Certifiying Security Auditors
From: Mark Teicher <mht @ clark . net>
Next: Re: Certifiying Security Auditors
From: Roger Books <books @ mail . state . fl . us>

Google
 
Search Internet Search www.greatcircle.com