-1

As a digital security consultant when is it 'ok' to use tools someone else made (dumb to reinvent the wheel, right?) and when should I make my own?

Improve this question
2
  • 1
    Am I right in thinking I should be able to make a similar programing, even if I am using someone else's?
    – November
    Jan 5, 2012 at 0:34
  • 5
    Am I the only one thinking that an expert in computer security would not need to ask this question? Even those of us who would not call ourselves security experts know that Security through obscurity is A Bad Thing and that good security tools are both open source and peer reviewed. You might also be interested in the IT Security stack exchange site.
    – Mark Booth
    Jan 5, 2012 at 12:14

5 Answers 5

Reset to default
5

Making bad tools is easy, especially in the security arena. Making good tools is actually quite difficult and requires a deep understanding of the problem at hand.

I would say stick with the pre-made tools until you know enough to actually improve them or replace them with something better. I've been in computing for almost 40 years, and I know that my understanding of most security threats is not good enough to "go it alone."

Improve this answer
2
  • so the pros are not necessarily making their own tools?
    – November
    Jan 5, 2012 at 0:36
  • @November Of course not. Do you think everyone wrote their own version of Wireshark?
    – user16764
    Jan 5, 2012 at 5:37
1

If it ain't broke, why fix it?

If it's broke, contribute to the project and help fix it for everyone else too.

Improve this answer
1

The best security tools are the ones which are transparent, open source and used and reviewed by lots of experts.

So for example PGP encryption is used by lots of people and hs been reviewed by lots of experts. It would be a bad decision to use some home encryption algorithm that you wrote yourself simply because they would not be reviewed and tested by a wide viriety of independent experts.

Improve this answer
0

If I were hiring a consultant, I'd like to see someone who actively contributes to the open source tools. This goes for security, test frameworks, whatever. If someone were using their own tools, I'd see this more as a high value add enterprise sale rather than pure consulting, which means a lot more money in the long run.

Improve this answer
0

As every expert independent of the area of expertise security expert should be able to use both:

Advantages of pre-made tools.

  1. Pre-made tools are usually well-established tools, their authors are known in the community and they have been already tested by many other experts. As long as the expert is requested to write something to support his opinion, the use of well-known tools will be a very good argument.

  2. Pre-made tools are usually those available to every expert. Hence you can easily reproduce the results of secutiry audit performed with a pre-made tool just by re-running the analysis. This is hardly possible with some custom-made tool you don't have access to or you don't know how to use.

  3. Using known tools for identifying common problems proves that expert is aware about these tools and doesn't try to reinvent the wheel while pinging your server or using telnet to check if any service is running on given port.

Advantages of self-made tools.

  1. Self-made tools show your expertise not only in your area, but also in programming that is always seen as a benefit.

  2. Self-made tools might grow into something bigger with time and ultimately become the standard tools in your area, contributing to your reputation as an expert.

  3. Self-made tool distinguish you from the experts who use only the standard tools, showing a higher level of proficiency or expertise. Even clever combining of existing tools would already do here and you can get a better offer or higher salary here.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.