How do you become an IT security specialist or expert? Primarily through experience and practice! There is no dedicated apprenticeship occupation for the field in Germany, but by now there are a few degree programs that have taken it on.
Where previously there were only continuing-education master's programs in this area, bachelor's programs are now starting up as well. I do not think dedicated bachelor's programs are the right approach. You cannot adequately "study" IT security in three years without accumulating far too many gaps in actual IT or computer science. I would rather recommend a pure computer science program in which you can ideally set a focus on IT security through elective courses. Even then you have to say realistically that you bring nothing but basic knowledge and usually negligible experience in IT security. It is a possible foundation for a career in IT security, but nothing more.
I am more positive about relevant master's programs such as Security Management at the Fachhochschule Brandenburg, Digitale Forensik (Digital Forensics) at the Hochschule Albstadt-Sigmaringen, or other master's programs at universities and universities of applied sciences. You should not start one of these without prior practical experience. That may be possible, but knowing practice as well is an advantage not to be underestimated. Ideally you work in a relevant position or area alongside your studies and can gather practice and theory at the same time. In my view that is the ideal approach for a career in IT security.
All in all, though, a degree is not strictly necessary. It always means effort (time & money) and has to be worth it for the person involved. There are plenty of self-taught security specialists or highly motivated technology enthusiasts who have reached their level without a degree. On top of that, degree programs in this field are still relatively new, and there is said to have been a time when not even the Fachinformatiker (IT specialist) apprenticeship existed. Overall it does show what else, besides experience and practice, an IT security specialist absolutely needs as a foundation: strong interest. Genuine enthusiasm for the field. Otherwise you will work in IT security but will not be able to become an expert.
What about the training courses – for CISSP (Certified Information Systems Security Professional) or T.I.S.P. (TeleTrusT Information Security Professional), for example? These are actually certifications for professionals with work experience, not an entry point into the profession. You also have to be clear that a five-day course may convey a lot of knowledge but does not turn you into an expert. Nor do you gather practice and experience that way. Anyone willing to carry the financial investment will still take something or other away from such a course. But whether you pass the exam in the end without experience – I doubt it.
My conclusion: you need enthusiasm for IT and IT security, and you have to gather experience in practice. As a theoretical foundation you can complete a master's program and later sit a certification exam as well.