mental characteristics of security
let's suppose you had to employ someone to protect your data, network, infrastructure, etc.
you have narrowed it down to two candidates and both have roughly the same level of experience and background, and both are easy fits into the organizational community. the only distinguishing factor between the two is that candidate A tends to omit factors of threat logically, based on circumstantial evidence that applies to the current environment. while candidate B only discounts the possibility. who wins in your book -and- why?
i guess i've heard too many {"no, this can't be done", "that is impossible"} type answers given to legitimate questions both here at AO and in the real world...and as always, i am confused about where they are coming from; and even moreso why they are supported. i'm not bitching or pointing fingers (most of it isn't even related to AO responses in particular) - just curious about the justification behind the elimination methodology.