WHAT IS A SECURITY EXPERT?

I've been referred to as a "security expert" over and over and i have detected over and over others around Maine referred to as a similar.

The reason i'm penning this article is that i'm pissed off by however some security consultants area unit seing and implementing security in their a day jobs.

But, let's begin with the beginning:

What will really build somebody a security expert? Or, once will somebody become a security expert?

The first issue that comes into my mind is, of course, his or her level of information during this space. The additional he is aware of, the better. i suppose that things like certifications in IT Security, articles written, books revealed area unit investigation.

An important issue ought to even be some "on the field" expertise (practical).

But is it enough to only be able to get employment properly done? obtaining the task done properly, is translating typically to "make the system as secure because it will be". we tend to all recognize that this does not mean something lately as a result of something you are doing it's solely valid for a really short amount of your time.

What concerning communication? it's not a secret that the largest downside with IT security in firms is that the proven fact that the safety individuals area unit generally not doing an honest job in "selling" security to those within the board. Often, this has as consequence that firms take security seriously solely once it's too late. fortuitously, per numerous media sources that performed surveys, security topics area unit currently additional usually on the board conferences agendas. this is often sensible, as a result of it helps United States become proactive and not reactive.

This development applies to the big lots of customers as well: they additionally aren't getting security seriously till it's too late. However, the explanation for this is often a small amount totally different than in firms. Most of the time not the budget or different priorities area unit the matter, because it is that the case with the businesses. Here the matter is that they're powerless to properly perceive the results of their digital life. several finish users still treat their on-line life as if would be a game of some kind, wherever their actions haven't got a reaction within the world (a.k.a. offline life). A security professional should be able to speak and work with persons United Nations agency area unit mistreatment computers as a tool to try to to their job. He must clearly make a case for the risks and facilitate them to boost their security employing a language they'll perceive.

It is vital to grasp from this rant that the scale back interest in security of the general public (consumers or not) is because it is, not as a result of they're stupid or less educated. individuals loathe to affect the subject as a result of it's sophisticated, it changes fairly often, it's ne'er finished, and, the foremost vital of all, as a result of it reduces the usability of no matter they require to try to to.

In my opinion, a true security professional should be able to produce a trade-off between security and value. A security professional must master the art of shaping the purpose wherever a system is "secure enough" however still usable for its users.

It has to be clear that it's inconceivable to realize each within the same time: most security and most usability. this is often why i believe that securing a system may be a job that's ne'er finished: the systems to be protected, their users and also the surroundings around them amendment additionally because the security risks they face.

As a conclusion, here is my outline of what i believe area unit the characteristics that build a security professional Associate in Nursing professional in his field:

Advanced theoretical data well-tried by international certifications
Practical expertise in applying security
Ability to speak with all levels, per their level of understanding, from board level to end-user
Ability to seek out solutions that don't seem to be in books and order them
Ability to look at the risks on the far side the plain and affect - be proactive and not reactive
Ability to decide on an answer that represents a good trade-off between security and value


Do you believe these?