There are many traits that are desirable in a security professional, but I believe there is one that tops them all. Integrity.

I suspect there are some folks who would protest this statement and cite other characteristics that they value in security pros. Curiosity, technical skill, work ethic, creativity, and more. I don’t want to downplay any of these traits, because they are highly valuable to me too. However, I think a person’s integrity is still the most important of them.

Our employers and clients must know they can trust us and our integrity if they are to hire us.

Why is our integrity so important?

Those who hire us give us access to some of the most sensitive aspects of their businesses.

Here are a few of the things we are entrusted with:

• Privileged access to critical assets and information

• Knowledge of where the business is vulnerable

• The responsibility to protect the business from disruption

Frequently, we are hired because we actually have the knowledge to exploit systems and how intrusions are conducted. Despite knowing that we have this capability, we are put in these positions of trust.

Integrity in action

Here’s one of many stories I could tell about how this has played out. Late one night, my employer, another consultant, and I were working on a penetration test. We were on Skype at 3am trying to keep each other awake, when my co-worker told us about a vulnerability he had found earlier that day. If exploited and not caught, it could be used to send a large amount of money (potentially millions of dollars) to the attacker.

It was a great find by the consultant and one that were both laughing over and congratulating him on. Our employer made a comment about how important it was that our client (and he) could trust us not to abuse the things we found. This was obvious to me, but also stuck with me.

If our employers can’t trust us to act with integrity, then they can’t hire us. Our reputation for living with integrity is the of the most vital asset we have.