A challenge, especially in the maturing world of Information Security, is that segregating IT security from the other disciplines makes it very difficult to manage a central risk register at board level.
While I got late to this beta, and I agree that this forum seems to be reasonably targeted, a part of me agrees with Gilles, as in my career I provide experience in all these areas, and it isn't that common at corporate level for a client to just ask for one aspect, so for example I might deliver a perimeter app test but also build in social engineering/physical penetration and an internal infrastructure security audit; closing the circle with a review of policies and standards against actual, and against industry expected practice.
How fast do the betas grow, typically - is it worth being welcoming to all in the startup phase and allow more offtopic (unless we have one which obviously fits into SO or SF) to get the traffic?
-
Was thinking about the crypto bit - and although it relies on a specialist branch of mathematics, IT security depends in no small way on crypto being implemented correctly. The two are very interconnected. Security professionals need to understand the basics of crypto to get the controls around it right, even if they don't understand the maths.