Kevin being an exception, I am not sure that being convicted of committing computer crimes is an indication of expertise in security. I would say it is an indication of lack of expertise or lack of common sense or both. So, if my choice was to hire a hacker with criminal record and a hacker without one ( given that they both passed the appropriate technical expertise tests with approximately same results ) I would hire a guy without a record, since he either was good enough not to get caught, or posessed enough common sense not to get involved with big angry important people ( like Mitnick did by the way ). I mean it probably boosts ones ego a lot to break into FBI DB server as oppposed to some on-line hardware store, but then again, if you have used a well known exploit on that DB server how are you different from any other script kiddie out there except for the fact that a bunch of heavily armed guys are on the way to your house :)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/3982/19374#19374