The unbearable lightness of strategic thinking ((mostly) in Cyber Security)
This article is a bit different than the previous ones (link to article 1 & link to article 2 ). But it opens a bit about the need for mindset and (strategic) thinking in cyber security, which were touched also on the earlier posts of mine. In general, the focus on thinking helps to build adaptive mind which then leads suitable actions whatever they may be, and which also are more futureproof.
Nothing is as practical as a good theory — Kurt Lewin.
Training is for known, education is for unknown — US Marine Corps.
Ideally, we must train and educate within an uncertain environment to prepare to adapt.
Rule number one on Descartes’ Rules for the direction of our mind states:
The aim of our studies must be the direction of our mind so that it may form solid and true judgements on whatever matters arise.
All scientific disciplines are tightly integrated to each other, and we shouldn’t study each of them separately. One should instead think what is a good way of thinking, or universal patterns, and turn them into wisdom, which helps to find the path on all of the disciplines combined. The key is to be able to find patterns.
Ergo, one perhaps would benefit integrating not only many of the sciences but also the arts into being artist playing music with science. This is because cyber security is a complex non-linear system — such as business, economics, politics, warfare, relationships etc and therefore may not be thought to be a strict science per se, although many try to approach it as such. And this combining not only on innovation area, but more chaotic the environment, more this kind of wide and hard thinking is bringing benefits for the capability to not only react but also shape the environment (as Miyamoto Musashi brought up the need to shape on the Book of Five Rings ).
Cyber security could be thought to be a chaotic environment; particles may be known, but their exact location is not known — and control is not fully achievable since the control is on attacker’s hands. (Also) With this mindset all of the technical matters could be played as a tune — including but not limited to; use them with their limitations.
Something more about this on the future posts, but in my personal opinion this could affect how to tackle deviations (and peace time, if such exist) from technical to strategical levels with strategic thinking so that high frequency activities are reached better to be in closer to control — state, and also being able to define tempo and thus building strategic resiliency instead of tactical resilience only. (military ordering as: strategical — operational — tactical).
The method in recent generations has been to select multiple campaigns, and to study them exhaustively as a means of professional training and as the foundation of military theory.
— British military philosopher B.H Liddell Hart
The above quote means that a very important thing, as demonstrated by the US Marine Corps — quote on the beginning of this article as well, is to study historical events. Since we cannot remember the future very well, history is the only existing place to study and learn the patterns and their interconnections to use to events unfolding in the future — even when the actual events may be different, the patterns can be familiar for the educated, and determined, person. Naturally the interpretation of history may be dependant of the person doing it, critical thinking strongly encouraged, looking all possible sides and try to sense more than see. Learning only one’s own mistakes is expensive, therefore learning from mistakes of others helps complementing the learning.
“The classic definition of an expert is someone who knows more and more about less and less until they know everything about nothing,” says DeVaul. “And people like that can be extremely useful in a very focused way. But these are really not X people. What we want, in a sense, are people who know less and less about more and more.”
The above quote can be interpreted (and I may be wrong) that they do seem to seek diverse set of people to the lab because on their research there may not be any existing rules how to categorize different matters especially those which previously were unknown but those rules are created based on information on the fly (seen, heard, experienced plus what comes out), which is one method of categoric learning. Only informational method used, could be zooming back and forth with similar approach than the first principles of physics. Similarly, the categoric learning approach is in line e.g what Immanuel Kant refers to on judgements of objects. And also helps to avoid categorizing adaptive challenges as technical(mechanical) problems.
Learning happens constantly; when resolving incident, trying to build, change, or even using the infrastructure, systems which means that the way to learn is also an important aspect to look for.
This could benefit e.g using John Boyd’s OODA-loop as a learning method. It most commonly is thought to be a decision method only, but its utility exceeds far beyond what it looks like at the first sight. One benefit to use it on many areas is that since people do mostly function on autopilot, meaning any method would benefit to be a routine, embedded into it which then can be executed in a flow without specific thinking, and therefore there may not be need to learn multiple other methods but to utilize as few as possible, only one which mirrors the characteristics of others; as a learning method, decision method, method for agile, designing an organization/team/self for agility and speed(rhythm/tempo), learning organization etc etc.
More personal thoughts to be continued…
