Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

As a digital security consultant when is it 'ok' to use tools someone else made (dumb to reinvent the wheel, right?) and when should I make my own?

share|improve this question

closed as primarily opinion-based by MichaelT, Bart van Ingen Schenau, Kilian Foth, GlenH7, gnat Aug 11 at 14:46

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Am I right in thinking I should be able to make a similar programing, even if I am using someone else's? –  November Jan 5 '12 at 0:34
5  
Am I the only one thinking that an expert in computer security would not need to ask this question? Even those of us who would not call ourselves security experts know that Security through obscurity is A Bad Thing and that good security tools are both open source and peer reviewed. You might also be interested in the IT Security stack exchange site. –  Mark Booth Jan 5 '12 at 12:14

5 Answers 5

If it ain't broke, why fix it?

If it's broke, contribute to the project and help fix it for everyone else too.

share|improve this answer

Making bad tools is easy, especially in the security arena. Making good tools is actually quite difficult and requires a deep understanding of the problem at hand.

I would say stick with the pre-made tools until you know enough to actually improve them or replace them with something better. I've been in computing for almost 40 years, and I know that my understanding of most security threats is not good enough to "go it alone."

share|improve this answer
    
so the pros are not necessarily making their own tools? –  November Jan 5 '12 at 0:36
    
@November Of course not. Do you think everyone wrote their own version of Wireshark? –  user16764 Jan 5 '12 at 5:37

The best security tools are the ones which are transparent, open source and used and reviewed by lots of experts.

So for example PGP encryption is used by lots of people and hs been reviewed by lots of experts. It would be a bad decision to use some home encryption algorithm that you wrote yourself simply because they would not be reviewed and tested by a wide viriety of independent experts.

share|improve this answer

If I were hiring a consultant, I'd like to see someone who actively contributes to the open source tools. This goes for security, test frameworks, whatever. If someone were using their own tools, I'd see this more as a high value add enterprise sale rather than pure consulting, which means a lot more money in the long run.

share|improve this answer

As every expert independent of the area of expertise security expert should be able to use both:

Advantages of pre-made tools.

  1. Pre-made tools are usually well-established tools, their authors are known in the community and they have been already tested by many other experts. As long as the expert is requested to write something to support his opinion, the use of well-known tools will be a very good argument.

  2. Pre-made tools are usually those available to every expert. Hence you can easily reproduce the results of secutiry audit performed with a pre-made tool just by re-running the analysis. This is hardly possible with some custom-made tool you don't have access to or you don't know how to use.

  3. Using known tools for identifying common problems proves that expert is aware about these tools and doesn't try to reinvent the wheel while pinging your server or using telnet to check if any service is running on given port.

Advantages of self-made tools.

  1. Self-made tools show your expertise not only in your area, but also in programming that is always seen as a benefit.

  2. Self-made tools might grow into something bigger with time and ultimately become the standard tools in your area, contributing to your reputation as an expert.

  3. Self-made tool distinguish you from the experts who use only the standard tools, showing a higher level of proficiency or expertise. Even clever combining of existing tools would already do here and you can get a better offer or higher salary here.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.