perpetuating the fundamental error
This initiative is likely to do little more than perpetuate the error of considering "cyber security" as a technological issue. It isn't - it's a conceptual issue. It's current state of weakness is a function of the same appalling quality of risk judgement that is increasingly evident in national policy decision-making (Katrina, Homeland Security, banking &c.). We have become so dependent on rule-based systems (both technological and social/legislative) that we have effectively ceased to be able to think flexibly and holistically. As a result we race behind the bad guys fixing a cascade of symptoms, unable to recognise, let alone address, the fundamental disease.
Contrary to popular opinion, software development is not such an overwhelmingly complex activity that it's impossible to create error-free code. You just have to pay attention, really understand what you're doing, and, most importantly, actually care about what you're delivering. It seems the majority of developers/programmers don't , don't and don't - not because they use abstracted high-level development tools but because they rely on such tools to absolve them from taking the personal responsibility for getting it right. It's an attitude problem before all, and is no different from the almost universal desire of our student population to get the degree without having to make the effort required to actually learn the subject.
We need people in charge of our security (and that includes not only "security specialists" but also application and service designers, programmers, testers, deployers, service managers and users) who actively seek to bear the requisite responsibility for fulfilling that task . Such people will make sure of their own accord that they are sufficiently competent to do so. Absent that attitude, no training programme will help.
Biting the hand that feeds IT
