Having worked in security for a number of years there are 2 types of security people. Type 1: Are super sharp guys that have spent time in half a dozen areas a

Having worked in security for a number of years there are 2 types of security people. Type 1: Are super sharp guys that have spent time in half a dozen areas and went to security because it was the only way to get the exposure they want to so many different things, they often also are associated with red team and the kind of people you want as security engineers. The second type is the type of people who focus on "security" who end up focusing on compliance and audit and are responsible for security theater. They may have a lot of certs especially the CISSP and are business savvy. They are also the most likely to do things like in the original post because they don't actually understand computers and what they are securing. The 2nd type give the 1st (which I hope I am) a bad name, and unfortunately are more common than not. The reason for this is that security has to be across every piece of the stack, if you have a single weak point then your entire stack is compromised. As a result you either have to be able to operate in all layers of the stack, which is very hard to get good at and understand and takes a lot of time and effort, or you trick yourself (and people who don't know what they're talking about) into believing that you can focus on just the "security" pieces of each layer of the stack. Which unfortunately means that things end up dogmatic, cargo culty, and vendor saturated because you don't have the understanding to make intelligent decisions only the understanding to follow "Da Rules" of security.