Cyberguardians

I know tons of people, myself included, are guilty of this. Were fresh off the heels of a Security Conference and we can't wait to blab about what new ideas we heard and what hot new products are on the market. Its our god given right to rant to people that we can't completely secure our network with out NAC or run on about the implications of podslurping and tools like jikto. Here in lies the hidden danger. Accountants, Managers and other non-technical IT folks are suddenly security experts after attending a CON. Armed with old, tired catch phrases like "Security is much more then patching and Antivirus Software" or "The biggest threat is from the inside". Yet, empowered by their newly obtained drivel, they go about the company preaching security, without any real technical security knowledge. And what scares me the most .... Management will listen :-(. I can't tell you how many times our objectives for the year get determined by what some non-security person heard at a conference. Its scary and slightly depressing. Yes knowledge is power and in the hands of the wrong person its downright dangerous. Many times what actually ends up in the listeners ear, is something quite different then what was initially said at the conference. But who knows, maybe Bob the accountant after his weekend in Orlando is really a security expert? Ha, highly unlikely, yet his coworkers and mgmt think so and thats what matters. This is how misinformation is spread. So the next time your thinking about sending your non-technical folks to a Security Conference, please don't. Send your hardworking, underpaid IT Security staff instead and you will get more out of it. Bob the accountant will be just fine going to a tax seminar in Jersey.