I recently came across this answer:

What should you do if you catch encryption ransomware mid-operation?

And instantly had an issue with the choice of words:

We are professionals and will help you get your files back.

I decided to edit this, replacing professionals with experts. This is due to my understanding that an expert is somebody with extensive knowledge of a certain field. On the other hand, a professional is an expert who has been certified to act ethically and professionally in their field.

The subsequent edit was rejected for the following reasons:

A professional is someone who gets paid for their work. Therefore ransomware developers are indeed professionals.

This is a valid point and one we can all agree with. However, I would say this definition doesn't go far enough. An extreme example is somebody who deals in the distribution of narcotics. They get paid for their work, but I personally wouldn't regard them as professionals. I believe the same can be said for Ransomware developers and distributors, getting paid through extortion doesn't comply with my definition of a professional who acts ethically.

Experts and professionals are two very different terms. Being expert puts a lot more weight to your opinion than being a professional.

What alarmed me here is the contradiction to my understanding, an understanding that was part of securing my BSc in IT Security. As aforementioned, my understanding is a professional is an expert in a certain field with the addition of certification that they act within the accepted practices/procedures within that field.

So I would like to know what our definition of an IT Professional is in the real world. I already know what I have been taught, but due to the contradictions I have received it seems right to clarify this.

| |
  • 1
    FWIW, "professionals" in the context of We are professionals and will help you get your files back. seems to be put to emphasize they are serious about their business model and will act professionally regarding their promise to give you your files back. I don't think "expert" would have conveyed the same. – Arminius Apr 4 '18 at 10:40
  • @Arminius you have a point. However, one of the reasons for rejecting my edit suggested that using the word "experts" would of gone further in portraying their seriousness. "Being expert puts a lot more weight to your opinion than being a professional". Just more reason for clarification. – Stephen King Apr 4 '18 at 11:08
  • 2
    Stephen - whether or not you get an answer that satisfies you, it is still not good form to edit the answer like that. We do accept substantial edits as long as they don't change the meaning intended by the original author. I have seen a number of your edits that needed rejecting because they were too minor, damaged the post or changed the meaning, so could you please re-read the guidance on editing before you do any more. – Rory Alsop Apr 5 '18 at 6:06
  • @RoryAlsop I agree completely with you. Like I said this post isn't about the edit being rejected, it was to do with contrasting reasons why. Apologises for the excessive edits, stack exchange gave me an inch and I took a mile. – Stephen King Apr 5 '18 at 7:07
  • 2
    a professional is an expert who has been certified to act ethically and professionally in their field I have worked with a lot of professionals who were neither experts nor certified to act ethically. In fact, I doubt that most professions have a certification authority that hands out certifications for people that states: "you are an expert and you will or have acted ethically". – Tom K. Apr 6 '18 at 12:29
  • Actually some infosec certs are like that. There's a very specific ethical code that you need to keep if you want CISSP for example. Not that you need that cert to write ransomware. – forest Apr 2 '19 at 4:14

I don't think the meaning of the word "professional" is relevant here. It can be used in many ways, and we do not need to agree on a definition to use. Just like with any word, you need to pick up the authors intention not only from the dictionary, but also from the context.

Your edit was rejected for two reasons:

  • It was very minor, not really correcting a problem.
  • It distorted what the person posting the answer wanted to say. The original wording got a message across. You might dislike that message, but then the correct action would be to downvote and/or comment.

I completely understand that the answer might be considered a bit offensive, but in this situation editing is not the solution. Remember, just because something is written in an answer does not mean that we as a collective stands by it.

| |
  • 1
    Appreciate the input and understand where you are coming from. However, I still believe an answer to my question would be highly useful. – Stephen King Apr 4 '18 at 12:42
  • @StephenKing The answer to the question "What is our definition of an IT professional?" is that we don't have one, and we shouldn't have one. We are not in the business of agreeing on definitions of common english words. – Anders Apr 5 '18 at 13:41
  • yet many people still have contrasting opinions on these common English words. johndcook.com/blog/2014/10/18/experts-vs-professionals – Stephen King Apr 5 '18 at 14:18
  • @StephenKing I'm not saying people don't disagree on the definitions of words, or that it can't be meaningful to discuss them. I'm just saying that meta is not a place where we make that kind of decisions, We have no security.se dictionary that we maintain. – Anders Apr 5 '18 at 14:30

I will explain why the definition is applicable, even though I agree with Anders that it is not relevant. We use the same definition used by any modern English dictionary. There is no infosec-specific meaning to the word. Generally, it can mean one of three things (paraphrasing from online dictionaries):

  1. Partaking in a particular profession for a living. This simply relies on the definition of "profession". Anyone who has a particular profession for a given subject is a professional in that subject. Example: My job is to write malware. I am a professional malware developer.

  2. Partaking in an activity often engaged in by amateurs. This definition simply differentiates an amateur from someone with more experience, when many amateurs are often engaged in the field. Example: I enjoy playing golf, but I am not a professional golfer.

  3. A way of behaving that gives off an aura of formality. This may be where you are getting mixed up. Professional in this context means behaving in a way that is respectable, formal, or ethical. Example: You should show professional behavior to your customers.

The ransomware developer is not discussing his behavior. He is stating a fact about his profession. So what is a profession? It turns out it does not require professional behavior:

  1. Taking vows for a religious community. Clearly, this is not the definition being used.

  2. A calling requiring specialized knowledge, often with involving formal education. This implies expertise. Formal education is not always required, but it is common. A person is more likely to become a professional neuroscientist by going to Stanford than at home.

  3. The principal vocation of employment. This does not imply any level of expertise. A person can be a professional janitor as long as it is their primary means of making money.

It is likely that this person was implying the second definition of profession in order to appear as an expert. This may or may not be true. Perhaps he is highly experienced in evading AV and has a very good understanding of the psychology of ransomware victims, or maybe he's just a hack who can barely write code that doesn't crash when it's run. This is irrelevant however as the third definition of profession is true. If this is the way he makes money as a living, he is a professional. You can argue that his behavior is not very professional, but not that this is not his profession.

So why is expert not a better term? Expert implies, of course, a certain level of expertise. By changing the term to expert, you are implying that the second definition of profession is correct, and that this person has a deep understanding of the field he is in, which may or may not be true. A professional simply has a job, an expert knows their job like the back of their hand.

| |
  • Often the categories of “professional” and “expert” overlap. But it is suspicious when someone is an expert and not a professional. It implies that their knowledge is theoretical and untested. As a result, I dispute the last paragraph. – Stephen King Apr 5 '18 at 15:21
  • 2
    @StephenKing Expertise does not imply only theoretical knowledge. It simply means one has a deep understanding of the concepts, whether or not they can put them into practice. – forest Apr 6 '18 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .