My theory has always been to hire people who understand how to think about security (that is have the right mindset) and enough technical skills to learn what they need to know. I've found this covers for issues like not knowing routers but being smart enough to find out what they need to know to do it securely. The business skills I can either coach them about or give them the opportunity to learn through other mechanisms.

If the post-grad program is focused on creating business managers of security teams then the focus on business over technology makes sense. Someone has to be able to justify the return on the security investment. The days of hiding behind the hack of the week to motivate management to fund IT security budgets is over.

On the other hand if the goal of the post-grad program is to develop leaders of teams that can assess and improve an organizations security posture than it is critical that the student learns the techincal and the business aspects of security. Too many "security" consultants just know how to read a checklist/guideline and not how to adapt the instructions to a specific system. How many of us have dealt with auditors that insist on turning on all Windows audit events without understanding the implications on storage and manpower to review (or usually ignore) the collected logs.

MBA thinks he's smarter than everyone else, film at 11.

I'm not sure I would want to hire someone for the business skills first, unless it's not a technical position. I mean, sure someone can cram and learn how to configure a router, but will that configuration be appropriate for 3 years? Will it have small nuances that non-newbies might have seen? And, like you mention, will it have been secure?

Granted, that's something that really only experience will give. And that might be part of the disconnect as well. Our industry is still growing and there will always be newer people coming in, especially as they tend to cost a bit less. ;)

A big amen to your last paragraph. Really well said.

Funny thing about MBA's ... when I worked with Venture Capital, there was an anecdotal joke about valuation of a software company. The joke went something like this: "for each engineer, add $1,000,000.00 to the valuation; for each MBA, subtract $5,000,000.00". I always wondered if someone with an MBA came up with that model. :)

As for education (back to HT's original post), I think he's right on the money ... from the Security Professional's perspective. There are far too many "Business People" running Security departments with no clue about Security. Some education in the Security space would be helpful for everyone involved, although I don't know what the non-Security CISO's motivation would be to spend this time educating themselves to a depth greater than conceptual understanding. Far too often, I've seen career executives put in charge of Security departments for the purpose of raising the profile of Security within the organization and to fulfill executive promotion needs. How do I make an SVP out of a VP? Put them in charge of Information Security for a couple of years. Sad, but all too often true. There are people in this world who are more concerned with their position than the subject matter that they're responsible for. With the move in many organizations to roll up Information Security under the Risk Management umbrella, I don't see this trend getting any better. At least CIO's used to hire CISO's. Under Risk Management, business executives will be appointing the head of Security. I'll leave it with you to do the math on that one.

Instead, I challenge those of us from the Security side of the fence to spend some real time and energy educating ourselves about business. I'm not talking about a 5 day seminar here. I'm talking about living on the business side for a couple of years; living it to the depth that we would expect business folks to live Security. Whether this is within a "customer" environment or on the vendor side, the only way to ensure that our corporate leaders understand and appreciate Information Security is to *become* corporate leaders.

The truth is that business will always win if we continue to make it a choice between business and Security. To revisit the example that prompted HT to write this post, If I'm looking for someone to run my Security department, I don't want to choose between Security and business - and I shouldn't have to.

If you can't beat 'em, join 'em ...

... then you can beat 'em.

Warning, long rant coming...

The disconnect is a good point, Tyler, but I urge you to think about this outside of technology for a few minutes.

We believe that, since we work in technology, that technology is somehow special. However, it's simply that we lack an abstraction layer, currently - there's nothing that isolates us from technology at this point, so we interface directly.

Let me ask it another way: when building a business, how much time do you spend on figuring out where the air conditioner units go?

The answer: you don't. Because you are focused on the business, and you hired someone to do the rest, which is just details. You gave your requirements ("keep us cool"), and someone handled it. You didn't need to think about the configuration of the pipes or the location of the vents - you were abstracted from that decision.

Now, of course, this doesn't work if you work for an Air Conditioning manufacturer - in that case, you need to hire people who know these things.

(In case you're thinking about this not being about security, go back and substitute "burglar alarm" for "air conditioner" above, and see if it still makes sense - it does).

The idea that a security person *needs* technical expertise is as ludicrous as saying that a business person *needs* to have been a janitor before they understand how to run their business.

In my experience, you need to understand the concepts, and, as Arthur pointed out above, need to know who to call for the technical expertise.

As for the product side, the disconnect you speak of doesn't exist. Having intimate knowledge of your business, I can say pretty clearly that the smart product developers in that business understand that there are TWO customers for any product: the manager who is making decisions (who buys the product for reporting and ability to interoperate with the environment) and the technical user who is actually running the product. Both need to be satisfied in the sales process, and there are features developed for both.

If you're making the assumption that there's a technical user on the other end of the product, you're making a fatal mistake: I can guarantee that 90% of your customers (most of whom I know ;) don't care about the difference between SMB on 139 and SMB on 445 - they just want to know whether they're secure, what they're going to need to do about it, and how much it's going to cost.

Which is as it should be.