Network Security Majors Guide

What Does it Mean to Study Network Security?

Every report of computer viruses or hacker attack brings renewed attention to the need for network security professionals. Although it is not a pleasant situation for the companies who suffer from these attacks, it means that now is a great time to begin a career in network security. Experts have predicted that the demand for security specialists will double over the next few years.

A career that barely existed two decades ago has become one of the fastest-growing occupations in the United States, and companies across the country are scrambling to find qualified people to fill those positions. It isn’t just large corporations that need protection. Government agencies, public schools, and small businesses–anybody who does business or is connected to the Internet–is at risk of being infiltrated by unwanted intruders. In fact, during one recent year 75 percent of the companies surveyed indicated they had experienced a serious breach of security.

In the past, many organizations found themselves understaffed and had to push the network security responsibilities onto network administrators or other computer specialists. Just a couple of years ago almost half of all network administrators surveyed said they also handled the security chores for their organization. These specialists might know their systems, but unfortunately they usually do not have the expertise to create the levels of security needed.

In these days of ever-expanding technology, the role of the network security professional has become essential for protecting consumers, businesses, government agencies, and citizens in general. With more business being conducted electronically and with more crucial personal information being stored on computers, executives have never been more obsessed with computer security. Add to that the explosion in wireless technology, and protection becomes an even more difficult assignment.

Network security is a field that encompasses many tasks. It includes all those activities that organizations and agencies conduct to protect the value and integrity of its operations. Effective network security requires identifying threats of all types and creating the most effective strategy to stop them. It involves software and hardware knowledge, but it also includes educating the employees within the organization about their security responsibilities.

What Does a Network Security Professional Do?

Network systems require protection from outside and inside an organization. And the more links that lead into that organization’s computers, the more difficult it becomes to protect the system. That puts the network security specialist in the hot seat to protect the system from intentional and unintentional intrusions.

Security threats tend to come primarily from two areas. The external group includes the hackers, commercial and government-sanctioned spies, vendors, and former employees. People are out there trying to invade your privacy, steal your money, or send viruses to damage your computer.

The second threat is internal and includes angry employees or current employees who cause unintended losses or security breaches. Innocently sending e-mails or chatting with friends can put a computer in danger. Accessing Web pages to do some online shopping or entering chat forums exposes each employee’s computer and the network in general to viruses or spyware.

A network manager has to be on guard against viruses, which are computer programs designed to replicate themselves and infect computers. These viruses may be intended as nothing more than pranks, but they can wreak major damage. The ILOVEYOU or Love Bug virus of 2000 may still be the costliest of all time — it caused an estimated $10 to $15 billion in computer damage and lost revenue and time. Trojan horse programs appear as harmless software programs but deliver destructive codes into the computer.

Businesses, such as banks, that store sensitive information, are subject to hacker attacks intended to collect data that can be used later to compromise a network, gain access to database information, or prevent the business from performing its services. Sometimes information can be used to withdraw money from accounts, make illegal purchases, or, as has been occurring more often, used to blackmail corporations.

Information can be obtained by intercepting data or by people posing as technical support personnel and getting passwords or other means of access from unsuspecting employees. For this reason, and because of the unintentional downloading of viruses, employees need to be aware of security functions within the organization.

Network security specialists have a number of tools at their command to counter these threats. Antivirus software packages counter most virus threats if they are regularly updated and maintained. Employees need to be informed of this necessity. A secure network infrastructure includes tools such as firewalls and intrusion-detection systems to protect all areas of the network and maintain secure connections.

Virtual private networks provide access, control and data encryption among different computers on the network. This permits remote workers to connect to the network without risking data interception. Encrypting messages helps ensure that they cannot be read by anyone other than the authorized recipient. Identity services assist in identifying users and controlling their network activities and transactions. Services include passwords, digital certificates, and digital authentication keys.

No single approach is sufficient to protect a network, but when combined they can be effective in keeping a network safe from most threats to security. Well-thought-out policies are crucial to control access to all parts of the network. This all occurs through network security management, which puts together the building blocks of a strong security solution.

A network security manager must combine technical and risk-management expertise with strong business knowledge. Only a part of the job involves working around a computer. Much of it includes working with other people. The network security manager must develop a plan that has to be presented to company officials and, once accepted, explained to everyone else in the organization who will play a part in implementing it.

The duties of network security personnel can be divided into three categories: planning, building, and administrating. More often these assignments fall onto one person, but larger organizations can provide additional personnel to assist.

Planning includes developing the policies, guidelines, and standards used create the product and technical architecture of the network. This requires a person with a fairly extensive background in computer security systems. They should possess a sense of what is strategically important to the organization and develop their plan based upon that information. It requires an in-depth knowledge of emerging security threats and solutions and an ability to identify, develop, and implement secure networks that will support organizational goals.

The security manager often takes on a project-management role. His or her job includes such duties as setting up and enforcing policies, determining risks to equipment and systems, putting into priority security maintenance, and managing system failures. He or she must develop a disaster recovery plan for any breakdown in the system. They may be asked to educate users on computer security, install security software, monitor the network for security breaches, and respond to system attacks. Sometimes they might be asked to gather evidence to be used in prosecuting cyber crime.

Building a security system entails the more technical aspects of network security, including the designing, configuring, and installing of security tools. Network security specialists must understand the intricacies of local area networks (LANs) and wide-area networks (WANs), telephone systems, and remote equipment. They should be familiar with state-of-the-art encryption technologies, Web-screening techniques, and cross-platform authentication. They make sure the firewalls and other security measures are working, and they maintain the network hardware and software, analyze problems, and monitor the network to ensure its availability to system users.

Career Education in Network Security

The bottom line is that a wide range of educational experiences will establish a solid foundation for a network security career. Security today involves many different challenges and professionals need a grasp of business and management issues, good interpersonal skills, and extensive knowledge of computing and networking technology.

A strong background in computer science or technology fields are the best course of action if no bachelor’s degree programs are available in network security. The student should have a command of computer architectures, operating systems, storage systems, and networking protocols in addition to security basics. A typical curriculum might include such courses as logic, programming, operating systems, data structures, quality assurance, and cryptography and data communications.

In addition to computer subjects, undergraduate students should supplement their studies with class work in statistics, psychology, English, foreign language, philosophy, ethics, and history. Many network security students add legal classes as a foundation for the privacy and liability issues associated with security.

What Can You Do With a College Degree in Network Security?

A career in network security does not have a fast track. Most of the top jobs require paying dues. It requires a broad range of experience and a commitment of time to acquire the necessary experience. On the positive side, it is a profession that can be financially rewarding, but to reach that level, a student needs to take stock of the skills needed.

One of the first requirements is to obtain an extensive background in information technology. A bachelor’s degree in computer science or engineering can be a good place to start. A person responsible for building firewalls, installing virtual private networks, and protecting a network against intrusion requires basic networking knowledge. Knowledge of technologies such as encryption and password administration is also required.

Another key is to have the combination of skills for network security project management. This includes not just the technical knowledge of security systems but a strong ability in written and verbal communications, an understanding of business needs, experience working with customers and vendors, and analytical and problem-solving abilities. Network security positions typically involve making presentations to senior staff and peers.

Because network security positions are often management positions, a person planning to move into the field should try to acquire project management or other supervisory experience. Employers will want to know that you can organize and run a program efficiently. Communication skills, people skills, trustworthiness, and the ability to learn quickly are other assets employers will seek.

Some network security experts have begun their careers in the military by training in positions with signals intelligence, intelligence, counterintelligence, psychological operations, or the military police. Others have pursued internships with Internet service providers (ISPs), managed security service providers or other companies that have internal security departments. These opportunities can provide a solid foundation into network security.

Other network security professionals began their careers in computers systems and networking jobs that included security responsibilities. Others came from backgrounds in administrative informational technology. Security personnel general have extensive knowledge of Unix, Windows, or mainframe systems administration. Regardless of where they start, people who move into network security benefit from having a solid foundation of technological tools and real-life working experience.

Organizations that use network administrators range from start-up companies to federal agencies. As the Internet, telecommunications, and e-mail continue to develop, even industries that are not typically associated with computers will need security-related workers. Firms across all industries are expanding or developing computer systems, which creates an immediate need for network security specialists.

In addition, federal regulations have mandated that banks, hospitals, insurance firms, real estate companies, and similar businesses protect sensitive customer information and have disaster recovery plans in place. This legislation was intended to prevent corporate financial scandals, but it has contributed to the growth of technology security officers in these services.

Many different opportunities exist for entry-level security personnel to break into the business. The professional is still in the developing stages for industry standards and a person with a good background in computer systems and knowledge of security remains attractive to many companies, especially smaller businesses. The beginner can also cut his or her teeth in other areas such as information security analysis or system analysis, while developing a security resume.

A number of major corporations, federal agencies, and security specialists need people who have specific security skills. Some of these areas include:

Firewall Specialist or Administrator

A firewall is a security system designed to prevent unauthorized access to or from a private network. It is a basic line of defense that is especially important in preventing people from outside a company network, or intranet, from entering sensitive areas. The firewall specialist sets up this security system and monitors it to guard against breaches.

Disaster Recovery Specialist

With the federal regulations requiring that certain companies protect information, some companies have discovered the niche of recovering data that has been lost due to network infiltrators or simply because of a major computer problem. These specialists are able to retrieve the information and restore it to its original form. In some instances a recovery plan is mandated.

Forensics Specialist

With the tremendous increase in cyber-crime, it is no surprise that one of the fastest growing fields is in investigating how the crimes are committed and gathering evidence. Computer forensics analyzes the information created within computer systems and devices to figure out what happened, how it happened, and who was involved.

Wireless Security Expert

The advent of wireless networks creates another, and potentially easier, target for unauthorized access. Various firewall, software, encryption, and other security are available to protect wireless networks. Once again, if the security and privacy of the information is critical, a specialist in this area might be called in.

Information Security Officer

This position could involve security in areas other than just network, but someone with network security background or hoping to move into network security would be a good fit. Responsibilities include the management and supervision of security measures to protect data and supervise the conduct of personnel in relation to data security.

FBI Investigator

Since 9/11 the FBI and other federal agencies have beefed up their investigations of cyber-crimes and anti-terrorism measures. The creation of a Cyber Division was responsible for bringing in more people with security expertise in general and computer network security specifically. The agency has placed the division as one of its highest priorities.

Preparing for Network Security Career Opportunities

Interpersonal and management skills are a must for the administrative duties of the network security person. This is where the day-to-day work is done. Security managers communicate regularly with the other professionals in the company such as business managers, sales division heads, company management, and informational technology personnel, to ensure that they understand the applications and business processes.

A number of large companies are turning to outside firms to provide security services and skills. This permits the primary company to concentrate on its specific business goals and to depend on its information technology provider to concentrate on those functions. This trend is creating a demand for skilled professionals who can take on these projects for the security firms.

Network Security Licensing and Certification

Licensing is not required for network security jobs, but certification almost certainly may be. The certification is for specific operating systems and security software. A part of the certification process also requires that professionals be re-tested periodically to maintain their certification and remain up to date with the latest technology changes.

Vendors such Cisco Systems, Guardian, Microsoft, Oracle, SAP, and Symantec, offer certifications in the security features of their own products. Other certifications might come from professional associations such as the Global Information Assurance Certification. Additional professional certifications include Certified Fraud Examiner, Certified Information Systems Security Professional, Systems Security Certified Practitioner, Certified Information Systems Auditor, and Certified Information Security Manager.

Learn More about Network Security

• The International Network Security Certification Consortium Inc., a nonprofit organization, at http://www.isc2.org.

For more information about forensics as a career, contact

• The High Technology Crime Investigation Association at http://www.htcia.org, or the SANS Institute at http://www.sans.org.

For more information about computer security in general, contact:

• The U.S. National Institutes of Health’s Computer Security Awareness Training Web page at http://www.cit.nih.gov/security
• The System Administration and Network Security (SANS) Institute http://www.sans.org/ or its Global Incident Analysis Center (GIAC) at http://www.giac.org.