11

I'm currently studying Computer Science, where we're teached Java programming. I want to get into the IT-security field, but it seems to me that Ruby and Python are more relevant for that, so I have a hard time motivating myself to learn Java.

But do Java have a place in modern IT-Security compared to say, Ruby or Python?

user37534
  • 113
  • 1
  • 4
  • 7
    Java has a place in security in all the wrong ways. – Steve Jan 19 '14 at 18:23
  • I think you should go into the "jack of all trades" path here. But just having some grasp of "how to make a GUI in Visual Basic to trace the criminal's IP" (lol) doesn't cut it :P So in other words, there's a long road ahead of you. – Camilo Martin Jan 20 '14 at 00:49
  • 1
    If it's a language that gets used for real-world applications, then it's relevant to security. Java certainly fits the bill as one of the most widely-used languages out there. – Mike Ounsworth Jul 07 '15 at 18:22

4 Answers4

25

Programming is relevant to IT-Security; it may be subtitled as "yeah, I kinda grasp the concepts of what I am blabbing about". You cannot be a decent practitioner of IT security if you cannot imagine what occurs in a computer beyond something like "then magic occurs". This necessarily implies some basic skills at development.

The exact programming language does not matter much. In fact, if the programming language matters to you, then you don't know enough programming yet. If you want to "get into the IT-security field" then you must reach the point where your question feels ridiculous, as in "how could I have been such a twerp to ask such a silly question ?". Meanwhile, go learn how to do basic programming in at least two or three different languages (Java may be one of them); this is the path to enlightenment.

Tom Leek
  • 172,594
  • 29
  • 349
  • 481
  • Could you clarify on "if the programming language matters to you, then you don't know enough programming yet"? – Heisenberg Jan 20 '14 at 02:20
  • 4
    @Anh: If you know one language, or are trying to only learn one language, you're naturally going to tend to look at every problem from that language's POV, and possibly try to shove it into that language's little box. If you're solely learning Java, for example, the concept of a buffer overrun might be too abstract to even make sense to you. You need to know something about at least a couple of different languages, including C and/or an assembly language, so you can step back and look at things from a more language-agnostic, more computer-centric POV. – cHao Jan 20 '14 at 03:34
  • 2
    Not just that, but the fact that most security flaw types are agnostic to the underlying programming language. You could equally have buffer overflows in C, C++, and Delphi. You might have poor password storage in any application, regardless of the languages and technologies involved. Even SQL injection is not limited to a particular dialect of SQL. – Polynomial Jan 20 '14 at 12:09
5

If you want to get into technical IT Security you should get a solid basis in all different subjects, programing, networking and system administration. Motivation to learn, often rather boring and complex subjects, is important. Only by understanding how something works, you can find out if it works securely or not.

Python and Ruby are as relevant as Java,C,LISP or even COBOL. Every single programing language is just a tool used to achieve your goal: perform a security assessment in an automated way. Python and Ruby are often used to write scripts, but this is not only relevant to IT Security, but just in general for the IT community.

Java is used less than Python and Ruby to create scripts, but it's definetely relevant to IT Security when it comes to, for instance, client side exploitation. You must also remember that these days a lot of application are being written in Java. Part of IT Security is to assess existing applications by looking at its source code. Having a solid basis in Java is imperative if you want to assess Java applications.

Lucas Kauffman
  • 54,437
  • 17
  • 116
  • 196
4

Java is in fact extremely relevant to information security because the Java Browser Plugin is one of the most prominent ways of malware distribution. See e.g. this recent article:

The Cisco 2014 Annual Security Report found that Java represented 91 percent of all Indicators of Compromise (IOCs) in 2013.

If you plan to work seriously in security, you're most likely going to be faced with a lot of malicious or vulnerable Java. This makes a basic knowledge of Java important, but more important yet is a solid understanding of programming and computing principles: you must understand what actually happens in a computer on a systems-level. You should learn several programming languages and become a competent programmer --- it goes hand-in-hand with working in IT security.

Moreover, to aid your understanding, you should not only use high-level languages like Java or Ruby or Python, but you should learn languages closer to the machine level (at least C, understanding assembler would also be good if you want to fight malware) if you really want to do security.

Newb
  • 183
  • 7
1

Does Java have a place? Oh Yes!

  1. As Newb answered, Java Browser Plugin was one of the biggest security holes in the past few years. Since I was a Java developer, I was able to help guide my organization, which still uses Java applets, through the pains of locking this down.
  2. Many, many web applications are written in Java web frameworks such as JSP, Struts, Spring, Java Server Faces. Many of these apps were written before everyone understood web app security so many organizations have critical and insecure Java apps. The security field needs people like you to secure these applications. As a Java developer, I have been able to find holes in Java applications that someone without Java experience would probably not find.
  3. Many security tools are written in Java. I'm thinking of Burp Suite, ZAP Proxy, Dirbuster and SOAPUI.
  4. Android is the most common mobile platform and the most insecure. Android apps are written primarily in Java. There is a huge need out there for people who understand Android and its application ecosystem security.
  5. This statement might seem funny after the long plugin nightmare, but Java was designed to help developers avoid many of the security mistakes possible in languages that came before. I'm thinking of: Array bounds checking, structured memory access, and type safety. C# and other languages adopted these features. Understanding the language and studying these security features will have broad application.
mcgyver5
  • 6,874
  • 2
  • 27
  • 47