I worked for a company and was known to be tech savvy. And one day the Credit Manager came to me and asked if I had a virus checker and if I would check his machine. Sure enough he had a virus.
The computer security guys had come around with a floppy drive insisting on checking everyone’s computer. The Credit Manager had protested because he doesn’t connect to anything with that PC, but they insisted.
Turns out they were using an unprotected floppy to check everyone’s computer and they were spreading the virus as they went.
Classic!!!
I worked in IT Security with some spooky dudes, including some who were quite famous. Even tho pretty much every company has someone with IT Security in their title or job description, the fact of the matter is that the bulk majority of the “security professionals” in the US today are woefully undertrained and lack useful experience. If you really want to find out how good someone is, ask if they have done 1) a physical security assessment of their company (i.e, they know how someone can physically compromise building security). 2. Managed and external threat assessment (i.e, hired a company to see if they can break in and how they did it). 3. Have an active response team, and have participated in Red Team/Blue Team exercises (Red Team employees pose as hackers and try to breach the company systems while Blue Team employees monitor for attacks and actively work to foil attacks). Finally, what do they do to train non-security staff in how to minimize exposure thru Security training. If you get blank looks on any of these, find another candidate.
Yep, I can well imagine!