Please check this interesting article about "Techies don't get security either".

The message of this article is compelling: pure security techies cannot progress beyond a point in their career hence folks who manage security in a company are most likely to have business background.

When I started acquiring business degree (MBA), it was more a "herd" mentality - hats off to tremendous _marketing_ from business schools. The business school marketing message is clear - get an MBA degree be a manager, director, entrepreneur, venture capitalist and so on..

In a company to manage risks it requires "business sense" which many security techies may not have - "business sense" involves communication skills, project management skills and political skills. Irrespective of my poor justification of entering an MBA program, on hindsight it turned out to be a good decision the program has given me some "business common sense".

I think security techies (or any techies) for that matter, acquiring "business sense" is a must to grow. Acquiring business degree is not the _only_ way to get business sense (which I was originally made to believe) - there are lot of good books - check out http://www.mypersonalmba.com