The prevailing mindset is that security practitioners are professionals, and thus, require a college degree. But there are some flaws in that logic.