Yeah, when you look at the industry standards that large enterprises use for IT security, is it any wonder? I am not an IT security expert by any means, but wh

Yeah, when you look at the industry standards that large enterprises use for IT security, is it any wonder? I am not an IT security expert by any means, but what I've noticed when I look at all of the industry certifications is a focus on taking network engineers and educating them enough to make them able to defend against attackers. What I don't see is any push to take software engineers and educate them about the lower level stuff to defend against hackers. Why is this a problem? In your typical large enterprise, software people are paid much better than network people. (remember, we're not talking about Google or Rackspace. administering a typical corporate network is relatively simplistic, since the level of variance in software is higher than in network configurations). I used to work in networking, and quickly got bored and learned software and GTFO of the lame networking world. The networking people I currently know who have obtained the CISSPA security certs have no friggin clue how to code, and frankly just aren't that smart when it comes to this kind of thing. The people I want defending our networks are the folks at DEFCON who are hacking into every other machine in the room just for fun. But if you look at the requirements for getting these industry certs, I don't think these people would even qualify. So you end up getting talented penetration testers and talentless people who have never hacked anything on defense.