Computerworld - Several lessons have been derived from the recent iCloud security incident, but the most important for me is how it demonstrates the ignorance of many security professionals, an ignorance that calls their management into question.
When the iCloud hack started hitting the news, it generated a lot of discussions among security personnel. Many of them grasped the underlying concepts reasonably well. Unfortunately, though, some of the conversations demonstrated a clear lack of understanding of fundamental security concepts.
As is widely known by now, a hacker was able to compromise the Amazon.com and iCloud accounts of a Wired reporter. The accounts were compromised as a result of operational security flaws in the password reset processes of the respective organizations. The attack itself was rather involved, but at bottom it was a fairly straightforward social engineering type of attack.
One thing that is clear is that the strength of the account passwords was completely irrelevant, since the attacker simply needed the password reset. Why, then, would someone who is supposed to be a security professional argue that the attack would not have been successful if the passwords had been stronger?
When I read that comment from a self-identified security professional online, I had to wonder about his qualifications. I soon learned that he had been reassigned to the information security department from another department and had no formal security training before the reassignment. That isn't the problem, though. The problem is that this person was not provided any training after the reassignment and did not seek it out.
This situation is not unique among Fortune 500 companies. Many companies have a hiring freeze, while also conducting layoffs. Frequently, that means that the security departments have to take whomever they can get. Even if there isn't a hiring freeze, many companies have a habit of encouraging employees to rotate internally for professional development purposes. This has the effect of encouraging security managers to accept people whom they might not otherwise choose.
Neither circumstance would be a fundamental problem if proper training were required. Unfortunately, many companies don't have an adequate training budget or an established qualification program in place.
This raises a couple of concerns, in my eyes. First, unqualified and untrained security personnel will clearly create poor security programs for their organizations. If they don't understand the issues, then they can't determine the most effective ways to secure their organizations.
Second, a lot of people ask security professionals for advice. If the professional doesn't really know what he is talking about, you end up with a lot of bad advice. That proliferates insecurity. Just as bad, if it becomes obvious that the advice is wrong, that will undermine trust in the security profession as a whole.
You are previewing premium content. 
Free Insider Guide