Anyone who has children, or has had to deal with very young children, will understand how powerful the word “why” is and how it can drive their curiosity. Innocent-sounding questions such as “why is the sky blue?” can lead to the question “but why?” to each of the answers given. A cycle of never ending “whys” is quite commonplace until it seems all the answers have been exhausted, but still they will ask “why?”

This small and seemingly innocuous word can also be one of the most powerful tools in the vocabulary of the information security professional.

Those same three letters that drive many parents crazy were also the driving force for many of the early pioneers in information security. Their curiosity and wondering “why?” led these pioneers to experiment, to poke, to examine, and to learn as much as they could about the computer systems, the networks, and the applications they used. This knowledge was then used to further improve those systems and today our interconnected world is a result of those people asking that simple question.


I believe that an inherent curiosity is one of the key traits every successful information security professional should have. That sense of wonder and seeking to find out why things work in a certain way, many times by breaking them, is what makes this profession such an exciting and interesting one.

Unfortunately, I have noticed recently that many people are no longer seeking to find out why things work in a certain way. We seem to have moved to an industry that is too willing to accept how things are presented to us without challenging it. We focus on compliance issues, react to media stories, listen to speakers at conferences, or swallow all the material that vendors pitch our way.

Instead of asking why, we are now asking who, what, where or when. Instead of asking “why do I need to be compliant with a certain standard?” we are asking “what do I need to do in order to be compliant?” Instead of asking “whom should I allow to have their device access the network” we need to be asking “why am I allowing access?” When vendors pitch their solutions to us we need to stop asking “what is the solution? Or indeed what is the problem?” and instead ask “why do I need this product?” For each answer to these questions we should continue to ask “why?” until we have exhausted all avenues of questioning and have a fuller and better understanding of the issues we are trying to address.