Buffeted by millions of digital scans and attacks each day, federal authorities are looking for hackers — not to prosecute them, but to pay them to secure the nation's networks.

General Dynamics Information Technology put out an ad last month on behalf of the Homeland Security Department seeking someone who could "think like the bad guy." Applicants, it said, must understand hackers' tools and tactics and be able to analyze Internet traffic and identify vulnerabilities in the federal systems.

actually it says to use -sI not -O but to answer your question.  look for boxes that are probably getting low or no traffic. when you do your reverse dns lookups see if any names jump out as probably dev or old boxes.  printers are discoverable on the net, use google dorks to find them.

that being said, its still pretty difficult to detect a system that has a routable IP that is just sitting there doing nothing.

http://nmap.org/book/idlescan.html

to test:

Attacker# nmap -sI Zombie -PN -p20-25,110 -r --packet-trace -v Target
Starting Nmap ( http://nmap.org )
SENT (0.0060s) TCP Attacker:51824 > Zombie:80 SA id=35996
SENT (0.0900s) TCP Attacker:51825 > Zombie:80 SA id=25914
SENT (0.1800s) TCP Attacker:51826 > Zombie:80 SA id=39591
RCVD (0.1550s) TCP Zombie:80 > Attacker:51824 R id=15669
SENT (0.2700s) TCP Attacker:51827 > Zombie:80 SA id=43604
RCVD (0.2380s) TCP Zombie:80 > Attacker:51825 R id=15670
SENT (0.3600s) TCP Attacker:51828 > Zombie:80 SA id=34186
RCVD (0.3280s) TCP Zombie:80 > Attacker:51826 R id=15671
SENT (0.4510s) TCP Attacker:51829 > Zombie:80 SA id=27949
RCVD (0.4190s) TCP Zombie:80 > Attacker:51827 R id=15672
RCVD (0.5090s) TCP Zombie:80 > Attacker:51828 R id=15673
RCVD (0.5990s) TCP Zombie:80 > Attacker:51829 R id=15674
Idlescan using zombie Zombie (Zombie:80); Class: Incremental

1) Well, 30 blogs is good, but there are many more. I have a custom OPML file which includes mine, most of my instructors from SANS, the security bloggers network, and tons of other feeds.

2) I also stay up on podcasts, as you do, i'm sure i don't have to name the big ones.

3) TWITTER... man i have to say.. TWITTER.  Create a  separate non personal account, and follow everybody. I follow most of the SANS instructors, podcast makers, security bloggers, AV companies, everyone. You will be surprised how often people release cool stuff early or exclusively  on twitter.

4) Stay up on CORE's and SANS Webcasts, also the SANS reading room and ISC.

5) Follow sites such as Dojosec.com, Learnsecurityonline.com, theacademypro.com, mubix's links, etc.

6) Go to Cons and training obviously.

7) Follow Syngress, Wiley, McGraw-Hill, publishing and check  their new releases.

if i think of more ill reply =)

Is the recording up for this yet?

I came up through networking so it helped me a bunch. Now working on the security side it helps when assessing network devices. I would say it wouldn't hurt, but it depends on your career goal. What are you wanting to do?