Computer security expert using pre-made tools or own?

Question

As a digital security consultant when is it 'ok' to use tools someone else made (dumb to reinvent the wheel, right?) and when should I make my own?

Answer 1

If it ain't broke, why fix it?

If it's broke, contribute to the project and help fix it for everyone else too.

Answer 2

Making bad tools is easy, especially in the security arena. Making good tools is actually quite difficult and requires a deep understanding of the problem at hand.

I would say stick with the pre-made tools until you know enough to actually improve them or replace them with something better. I've been in computing for almost 40 years, and I know that my understanding of most security threats is not good enough to "go it alone."

Answer 3

The best security tools are the ones which are transparent, open source and used and reviewed by lots of experts.

So for example PGP encryption is used by lots of people and hs been reviewed by lots of experts. It would be a bad decision to use some home encryption algorithm that you wrote yourself simply because they would not be reviewed and tested by a wide viriety of independent experts.

Answer 4

If I were hiring a consultant, I'd like to see someone who actively contributes to the open source tools. This goes for security, test frameworks, whatever. If someone were using their own tools, I'd see this more as a high value add enterprise sale rather than pure consulting, which means a lot more money in the long run.

Answer 5

As every expert independent of the area of expertise security expert should be able to use both:

Advantages of pre-made tools.

1. Pre-made tools are usually well-established tools, their authors are known in the community and they have been already tested by many other experts. As long as the expert is requested to write something to support his opinion, the use of well-known tools will be a very good argument.

2. Pre-made tools are usually those available to every expert. Hence you can easily reproduce the results of secutiry audit performed with a pre-made tool just by re-running the analysis. This is hardly possible with some custom-made tool you don't have access to or you don't know how to use.

3. Using known tools for identifying common problems proves that expert is aware about these tools and doesn't try to reinvent the wheel while pinging your server or using telnet to check if any service is running on given port.

Advantages of self-made tools.

1. Self-made tools show your expertise not only in your area, but also in programming that is always seen as a benefit.

2. Self-made tools might grow into something bigger with time and ultimately become the standard tools in your area, contributing to your reputation as an expert.

3. Self-made tool distinguish you from the experts who use only the standard tools, showing a higher level of proficiency or expertise. Even clever combining of existing tools would already do here and you can get a better offer or higher salary here.