Printable View
Rather than dragging up all of the old Computer Security 101 Tutorial threads I thought I would just create a new thread to let everyone know that the quiz for the lesson is now available.
Here is a link to the tutorial thread: Computer Security 101 - Lesson 3
Here is a link to the quiz for this lesson: Computer Security 101 - Lesson 3 Quiz
Have fun!
This questionnaire is extremely naive, its answers are wrong.
Question 4:
How many ports are there for TCP and UDP?
a) 1024 b) Unlimited
c) 32348 d) 65536
Correct answer: 65535, seeing as port 0 does not exist and cannot be used, however it isn't an option. (Update: port 0 does exist, but apparently still cannot be used as implementations do not allow it to be used. I have yet to find any document which states this officially. )
Question 10:
The standard port used for file transfers using the FTP protocol is?
a) 25 b) 80
c) 21 d) 110
Correct answer:
None of them, FTP never uses any of those four ports on the source or destination for transferring files (port 21 is the ftp control port, and is only used for sending commands and responses) Instead it uses its data connection, which *sometimes* originates from port 20, but can be dynamically assigned
Slarty
You already updated the number of ports issue so I won't address that.Quote:
None of them, FTP never uses any of those four ports on the source or destination for transferring files (port 21 is the ftp control port, and is only used for sending commands and responses) Instead it uses its data connection, which *sometimes* originates from port 20, but can be dynamically assigned
As for this one, I see your point and maybe I will change the wording to make the answer correct. The standard FTP port is 21 which is all I was trying to get at.
The TCP port 0 issue is a bit of a weird one.
In operating systems that use BSD sockets or a derivative of BSD sockets (for instance all Unix and Windows), the bind() function cannot bind a TCP or UDP socket to port 0. Therefore you can neither have a TCP socket listen on, nor attach a UDP socket to, port zero.
I assume however, that under operating systems that don't use BSD sockets (like there are any?), then binding a TCP socket to port zero works.
In principle I don't see any reason why you can't send traffic to port zero. It's just that the BSD sockets API does not allow applications to use TCP or UDP port zero.
On a search of the internet I found a snort rule which matches TCP port zero traffic and flags it as an intrusion; I can see why - nothing can use it hence it is malformed (in practice) - even though it may be valid in theory.
I like these little tut you give us, and you tell us when they come out, Have you ever thought about make a book? Maybe like "How To book" or what about the old logo "Hackers know the weakness in your system, Shouldn't you." Just a thought.
Cya
also, once you miss one, the answers to the following answers occasionally showed up light purple, signifying they were wrong.
Pretty tricky. Don't give away secrets to help others cheat. :-)Quote:
also, once you miss one, the answers to the following answers occasionally showed up light purple, signifying they were wrong.
No offence, but I didn't find any security related question!?! Why so often Security 101 is more like Networking 101? I don't know if it's me, but I think it's important to know networking *before* security and not learning networking *with* security.
Have you read any of the actual tutorials?Quote:
No offence, but I didn't find any security related question!?! Why so often Security 101 is more like Networking 101?
I would suggest you go look at the actual Computer Security 101 series to get a feel for where it is coming from.
You are right that there is more of a general networking and computer slant than security. That is by design. The series is designed to take a novice and give them an understanding for the technology and terminology behind it all. If you don't know what TCP or DNS are and you are totally confused when people say that you should "block a port" it is difficult for you to understand how or why you should secure it. The lessons get progressively more complicated, but even by the 10th lesson I will not have gone into steganography algorithms or anything so complex.
In the future I will post more quizzes that are more difficult and not related to this Computer Security 101 series. I think these quizzes fit well with the lessons they relate to though and are good for the intended audience.
I agreed that is *essential* to know networking before security. From my point of view, is not enough to have a crash course in networking to be proficient in security. But, I'm working in computer security for some time now and sometime I forgot that not all material are for professional or semi-professional.
I read some of the lessons, it's great for home users!
Actually, yes.Quote:
Have you ever thought about make a book? Maybe like "How To book" or what about the old logo "Hackers know the weakness in your system, Shouldn't you." Just a thought.
I am working on it now. I am attempting to write a longer book version of the Computer Security 101 series. The intent will still be to provide a novice, specifically a home user, with the basic concepts of how their computer works and interacts with the Internet and what the pitfalls are.
I consider it somewhat of a crusade to try and get the home user market to take on more responsibility when it comes to this Internet community we all share. You don't have to be a "guru" to perform the basic acts of keeping your system patched and running current antivirus software or whatever.
If anyone has any specific points or ideas they feel should be driven home to this market in a book like this I would be interested in the feedback. You can PM me or email me at [email protected].
The trick is in the marketing. Home users don't even know that they're ignorant of the security issues. They don't know what they don't know so they aren't going to walk back to the computer section at Borders and peruse the titles looking through various CISSP study guides until they find the book they're looking for. The fact is- they won't look for it.
So, it is part of my goal to find alternative methods of marketing that will put the book in front of the home user market. They can't buy it and learn from it if they aren't aware that it exists.