What defines a computer security expert?

Question

It seems everyone I meet is an expert on security!

What defines a computer security expert?

Answer 1

You're lucky - make the most of the opportunity to learn from all the experts you meet. And learn how to detect which of the self-proclaimed experts actually are experts and which are just trying to jump on one of the current band-wagons.

Regarding your second question: caution

Security experts seldom take anything at face value. They investigate and check. And they don't proclaim until they're sure.

Answer 2

I guess no one appriciated the joke -_-

In my opinion, a security expert is someone who fully understands the material he/she is talking about.

Someone who keeps up to date with security exploits and vulnerabilities so they are never kept in the dark.

Answer 3

Really, as someone who's been a computer security researcher for, oh, 25 years, I know exactly what you mean.

Personally, I think someone who claims to be a security expert should be able to at the very least:

• describe CIA — "confidentiality", "integrity" and "availability" not the other one in Langley.

• identify basic security concepts like "trust" and "policy"

• understand threats, threat modeling, and how to build a threat pofile

• understand how cryptography can be used to preserve all three of the CIA triplet.

• know some of the general protocols, like SSL, Kerberos, and so on

• know enough to laugh when someone says "I want a completely secure system" or "my system is completely secure"

Surprisingly many of them can't.

Answer 4

I'm not. I gladly defer to anyone who wants to take responsiblity for it. (But I don't have much use for assertions made without taking responsibility for the consequences.)

The only people I've met who claimed to be, and whose judgment I trust, were explicitly local. And usually quite humble. A cocky security expert is a non sequitur, IMHO.

Answer 5

Start -> Control Panel -> Windows Security Centre

:)

Because they don't know what they don't know, and the repercussions of that have not yet hit them.

Because there is always someone else they know who knows less about computer security than they do - by comparison they are an "expert".

Because to be an expert in computer security probably doesn't require that one is an expert on computer security in all domains - one could be an expert in, say database security for MS SQL Server while knowing very little about database security for MySQL.

Because there are so few real computer security experts out there, there are very few people capable of telling the difference.

Answer 6

In my opinion, all programmers should try to become security experts - the one who is writing the code is best positioned to know how that code will behave, and if they have an understanding of the common attacks, they can improve the code from the get-go.