Is Information Security Education Failing?
By Daniel Miessler on December 19th, 2006: Tagged as Education | Security
A friend of mine is finishing his Masters in Information Security and just told me the craziest story. As a bonus question on the final exam in his information security management class, the professor asked if it was ever possible to guarantee e-commerce security if one were to implement security recommendations such as SET and SSL.
Can we guarantee the security of e-commerce if we adopt all recommended security mechanisms including SET and SSL?
Half the class — over 30 people — answered yes.
The professor got so infuriated that he threatened to fail everyone that answered in the affirmative. I think he’d be completely justified if he were to do so. I seriously can’t believe this many people are about to enter the security field — some of them probably as managers — without understanding this key concept.
If I were the professor, I’d send out an email to those who got it wrong that simply said, “You make me sad.” – [Edit: Posted the actual question, which was more specific than just "perfect security" in general]
