Universities and colleges are pumping out more and more software engineers each year. Yet it would seem to many in the industry that the quality of these freshly minted graduates is decreasing. Perhaps "quality" is too harsh a word -- "immediate usefulness" would likely be more appropriate. What's the problem?

During my career I've been lucky enough to work with and manage several of the world's most renowned security engineering and research teams. In some cases, it may have been the pedigree of the development teams that made it inappropriate to recruit new graduates or anyone with less than five years of experience, but in other cases, with tight deadlines and demanding schedules, the development teams themselves weren't prepared to expend the energy and time retraining a newbie.

That problem of "retraining" has always gnawed at me and, during the past year or so as I've worked with a growing number of universities and computer science professors around the world, I think I have a better understanding and articulation of the root cause to the "usefulness" problem when it comes to new software engineering graduates.

At its crux, the delta between university and commercial development can largely be attributed to two missed opportunities in the computer science:

I suspect that many of the old-hands charged with running engineering organizations or leading development teams are nodding to themselves right this moment -- wishing, too, that the next batch of newbie engineers pouring out of the college and university gates were better prepared for the careers they have chosen.

The disparity between the skills newly minted software engineers arrive with and the operational needs of the engineering teams they eventually join are felt acutely within the security industry. It takes a special and finely honed engineering skill set to make legacy applications and the code they're written from more secure. Merely sitting through a course covering the secure development life cycle (SDL) isn't enough to make a difference -- new engineers need the communication skills to negotiate and socialize ideas with their colleagues, and the ability to tweak existing code snippets and routines if they're to be useful within the first few months of on-boarding.

Gunter Ollmann, CTO, IOActive Inc.