The Cyb3rSyn Kaleidoscope - Episode 2

We are going to cover a diverse set of topics in the 2nd edition of the Cyb3rSyn Kaleidoscope… Let’s dive in.

Table of Contents

• The zero-sum game of security vs productivity!

• The “𝘋𝑖𝘯𝑔 𝑎𝘯 𝘴𝑖𝘤ℎ”

• Cyb3rsyn Newsletter: Preferences

• Burning Man

• Thoughts on Risk Mitigation

The zero-sum game of security vs productivity!

Travis McPeak (Co-founder and CEO of Resourcely) posted about what he called as the “security poverty line”:

I’m sympathetic to where Travis is coming from and to be honest I’ve also heard this from so many different cybersecurity professionals (even in “cash-cow” Silicon Valley firms) over the years…

Here’s is my take:

We as an industry know “WHAT” to do to solve security problems. For example, we know that FIDO keys are effective for mitigating phishing attacks.

But, the real challenge is not the “WHAT” but the “HOW”.

How do I get it implemented and rolled out in MY organization - with all of our “legacy” apps, “proprietary” frameworks, budget “constraints”, prioritization conflicts, etc.

You see, there are no security problems in any organization!

For example, if the CISO of a company says that Vulnerability Mgmt. is broken in an organization, that’s just the perspective from the cybersecurity organization.

When you start peeling the proverbial onion, you’ll notice that what’s really “broken” (or non-existent) is one or more of the following: Asset Mgmt. (Inventory), Config Mgmt., OS Image Mgmt., Automation, etc. in a complex web of interdependencies with so many other variables like budget, profit, promotions, headcount, etc.

Typically, there’d be many leaders individually chasing their own local efficiencies without any insight into global effectiveness and the long-term implications.

Security vs Productivity!

Security vs Innovation!

Security vs Velocity!

They play many such zero-sum games…

In a way, leadership is about achieving seemingly opposing or paradoxical goals.

But such problems are only abstractions - they exist only inside our heads.

You see, we can’t fix software security in isolation without fixing the underlying software development practices.

And that in turn depends on many things but a powerful factor is the underlying management systems in place.

Changing those management systems can’t happen without the existing leaders changing their minds, unlearning and relearning new ways of working.

The “𝘋𝑖𝘯𝑔 𝑎𝘯 𝘴𝑖𝘤ℎ”

In Kantian philosophy, the Ding an sich (German for “thing-in-itself”) is the status of objects as they are, independent of representation and observation. It was met with controversy among later philosophers.

Can there be any observation without an observer? How can one discount the role of the observer?

Let’s consider the “physical reality” we all know… Colors and sounds don’t really exist in the universe. Colors only exist inside our brains - that’s how your brain perceives photons of various frequencies.

Whether you are inside your home or office or out on a mountain, the entire “reality” your see is constructed by your brain. Sounds are just vibrations of air molecules.

Your qualia is yours and my qualia is mine - there is no way to independently prove that the way I perceive sky’s blue color is the same as you do.

Now, let’s consider “social reality”. John Cutler (I’m a subscriber to his newsletter - highly recommend it!) recently made a very insightful post about a seductive trap that many leaders fall for in a corporate setting. He rightly says:

In the social realm, what is truly missing is a pluralistic/multi-perspective approach. Systems Thinking can help here… As the systems thinker C. West Churchman put it,

But, here is the irony. Even the institutions/consultants that claim to teach Systems Thinking, actually end up teaching Systems Dynamics and Causal Loop Diagrams (CLD) which are not very pertinent here.

Instead of CLD, you’d be better off learning about Strategic Options Development and Analysis (SODA) which uses interview and cognitive mapping to capture multiple perspectives of an issue. The implications of Second Order Cybernetics is still underrated in the mainstream. More about that in a future post…

Let me end this section with a pertinent quote from Heinz von Foerster

Cyb3rsyn Newsletter: Preferences

One more new feature update to the subscribers of the Cyb3rSyn newsletter!

If you are logged in as a subscriber you can set your preferences now. On the “Manage Subscriptions” page, you can now easily update your preferences. The brand-new preference center allows you to:

• Change you email address

• Edit your name

• Review previous receipts

• Downgrade or unsubscribe

• Update your preferences

I’m curious to learn more about your persona so that I can customize content appropriately. Of course, you can always hit reply to the newsletter email and send me a note directly.

Subscribe to "I'm Serious" to read the rest.