Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know its kind of a "hard to answer" question, but I was thinking, googling and reading about it for a week and I still can't make a decision. So, where do you think the future of computer security is? Web applications? Smartphones, Androids, etc? Computer security focusing on worms/viruses, which are a big threat in the last few years? I am asking, because I am choosing my polarizatoin on university right now. Thanks.

share|improve this question

closed as not a real question by AviD Jul 25 '12 at 6:57

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Hi @Onan, welcome to Information Security. Sorry we had to close your question, but it's not really the types of questions that fit our SE format. Please take a look at FAQ, and also read How to Ask. Thanks! – AviD Jul 25 '12 at 6:59
Oh this is really not hard to answer, the future of computer security is that the exploits will cease to exist, the networks will be finally protected, the data stored safe at my home, and null terminated strings in C will be deprecated forever. – Andrew Smith Jul 25 '12 at 7:47
@AndrewSmith Keep dreaming ;), And null terminated strings aren't all bad, they just don't mix well with pascal style strings in standards like x.509 – ewanm89 Jul 25 '12 at 10:31

The future or security depends on the domain, there are a few "curves/paths" to consider

  1. Applications will get more complex - more room for bugs and holes
  2. Security is big business and is part of more com sci programs, younger programmers may have more knowledge and inclination to care about security
  3. Complete platforms with apps are becoming more popular - iphone, xbox 360, etc. By limiting the developers and the deployment options, vendors can (but not necessarily) may have more security reviews
  4. At the same time, there are more web apps then desktop apps - you have one website/app with many attack vectors (database, javascript, backend language, SSL)
  5. At the same time, "older techniques" are becoming more difficult and security is being built it - address randomization, sandboxing, DEP, etc.
  6. In addition, new programming paradigms and processes are emerging- there is a greater focus on the process then the end product, so more debugging, helper functions, frameworks which provide methods to automatically filter out injections

Now that is a general picture of where security is going. There is a greater consciousness for security, and constant changes in vecotrs; however, single activities may be very complex, interact with many systems, so there is room for holes anywhere.

It sounds like you are looking for an area to specialize in for your studies. My recommendation would be to get as broad as possible experience - everywhere you can. Unless you are planning on being in QA, as a security person, you need to be well rounded. In a corporate IT security role, you will need to primarily know how to manage the operating system security and security process. Do you know how AD works, how to set up permission? RACF for mainframes? PAM on linux? You may find that you would have a half security half sys admin role. If you are a hardcore programmer, you know C++ and assembly, then you could get a position as a virus researcher or developing algorithms to stop decompilation. These jobs are far fewer, but if you have the qualifications you will have fun looking through code and trying to bend it. If you want to be a pen tester, you really need to know how network traffic works, patch management, how to research exploits given information you discover on the fly (e.g., found this service I have never seen, connect with telnet/netcat and try to get a response or find someone who knows how the service works and try to get it to give me data). You could also be in QA or development or do application and web application pen testing, which requires knowing effective programming and just knowing how to spot things which are wrong.

Ideally, you should get experience everywhere. Unless you find a small niche shop, you will likely be doing a wide array of "security things". You might also end up in Audit, which often in IT is security-focused, but is not quite security. You are unlikely to be a "worm specialist". If you have programming chops, you may be asked one week to look at an iPhone app, the next week a web app. You need to know how to write those types of apps first before you can start to break them.

Likely, your background is either sys admin and IT or its programming. If its programming, learn as many languages as possible, make sure you understand databases as most apps regardless of devices, desktop, or web will write data to databases. If you are a systems or general IT guy, you might not be a "code" guy and instead you can focus on system hardening and network level security (firewalls, SIEM, log management).

Again, the key is to be a quick learner and to experiment in a lot of area. Grow your knowledge over time. You are better off long term being a generalist; you could be a SAP identity management specialist, but if you can't find a company who has SAP or cares about security or if SAP just dwindles in popularity, it will get real tough real quick.

share|improve this answer
Saw this paper, thought it was a good read for those interested in this question. – Eric G Jul 27 '12 at 3:16

I think it's safe to assume that computer security is only going to become more and more prevalent as time goes on and as our reliance to computers gets greater and greater.

The last two years have put computer security on the radar of many people who may not have paid any attention to it if it weren't for the brazen efforts of Anonymous, LulzSec, UGNazi, etc. These people made a clear point in that if Sony and FBI have security holes that can be exploited, than less sophisticated systems certainly can too. There have been a lot of SysAdmins that have been double and triple checking configurations of their systems in light of the actions of some.

Even on a personal level, rootkits and Trojans are becoming more vicious and better at concealing themselves, making it easier to harvest online banking credentials and wipe out an account in the blink of an eye. Many people don't comprehend how systems security works, and as a result are looking for someone with experience and the credentials to prove their experience. I predict that many people are going to be looking for computer security experts in the coming years.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.