I know its kind of a "hard to answer" question, but I was thinking, googling and reading about it for a week and I still can't make a decision. So, where do you think the future of computer security is? Web applications? Smartphones, Androids, etc? Computer security focusing on worms/viruses, which are a big threat in the last few years? I am asking, because I am choosing my polarizatoin on university right now. Thanks.
closed as not a real question by AviD♦ Jul 25 '12 at 6:57
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
The future or security depends on the domain, there are a few "curves/paths" to consider
Now that is a general picture of where security is going. There is a greater consciousness for security, and constant changes in vecotrs; however, single activities may be very complex, interact with many systems, so there is room for holes anywhere.
It sounds like you are looking for an area to specialize in for your studies. My recommendation would be to get as broad as possible experience - everywhere you can. Unless you are planning on being in QA, as a security person, you need to be well rounded. In a corporate IT security role, you will need to primarily know how to manage the operating system security and security process. Do you know how AD works, how to set up permission? RACF for mainframes? PAM on linux? You may find that you would have a half security half sys admin role. If you are a hardcore programmer, you know C++ and assembly, then you could get a position as a virus researcher or developing algorithms to stop decompilation. These jobs are far fewer, but if you have the qualifications you will have fun looking through code and trying to bend it. If you want to be a pen tester, you really need to know how network traffic works, patch management, how to research exploits given information you discover on the fly (e.g., found this service I have never seen, connect with telnet/netcat and try to get a response or find someone who knows how the service works and try to get it to give me data). You could also be in QA or development or do application and web application pen testing, which requires knowing effective programming and just knowing how to spot things which are wrong.
Ideally, you should get experience everywhere. Unless you find a small niche shop, you will likely be doing a wide array of "security things". You might also end up in Audit, which often in IT is security-focused, but is not quite security. You are unlikely to be a "worm specialist". If you have programming chops, you may be asked one week to look at an iPhone app, the next week a web app. You need to know how to write those types of apps first before you can start to break them.
Likely, your background is either sys admin and IT or its programming. If its programming, learn as many languages as possible, make sure you understand databases as most apps regardless of devices, desktop, or web will write data to databases. If you are a systems or general IT guy, you might not be a "code" guy and instead you can focus on system hardening and network level security (firewalls, SIEM, log management).
Again, the key is to be a quick learner and to experiment in a lot of area. Grow your knowledge over time. You are better off long term being a generalist; you could be a SAP identity management specialist, but if you can't find a company who has SAP or cares about security or if SAP just dwindles in popularity, it will get real tough real quick.
I think it's safe to assume that computer security is only going to become more and more prevalent as time goes on and as our reliance to computers gets greater and greater.
The last two years have put computer security on the radar of many people who may not have paid any attention to it if it weren't for the brazen efforts of Anonymous, LulzSec, UGNazi, etc. These people made a clear point in that if Sony and FBI have security holes that can be exploited, than less sophisticated systems certainly can too. There have been a lot of SysAdmins that have been double and triple checking configurations of their systems in light of the actions of some.
Even on a personal level, rootkits and Trojans are becoming more vicious and better at concealing themselves, making it easier to harvest online banking credentials and wipe out an account in the blink of an eye. Many people don't comprehend how systems security works, and as a result are looking for someone with experience and the credentials to prove their experience. I predict that many people are going to be looking for computer security experts in the coming years.