What Is Security?

The work you do in cybersecurity is critically important to the future of humanity, but nobody ever tells you that. It's true, and you need to know why.

One of the great ironies of security is how misunderstood the concept and implications are. I have worked in cybersecurity since I was 16 and never thought to take a step back and understand what security really means.

This article is an attempt to do so for myself, and hopefully for you as well. Admittedly, it's a step outside of my intellectual comfort zone. I'm doing my best to relate several broad and emotionally heavy concepts back to the world of cybersecurity. I'm bound to get some things wrong, but the topic is important enough to try.

Safety and security are basic human needs, yet most people are only aware of this subconsciously. We take security for granted when we have it and react aggressively and impulsively when we don't.

The forces and dynamics that ultimately make us secure seem mystical and abstract. Security is a complex subject, but a we can gain clarity by making a few important dynamics about human nature explicit. We need to take a step back if we want to find the true meaning and purpose of our work in cybersecurity.

The real epiphany lies in exploring the meaning of security far below the surface-level definitions we're used to inside the modern industry. Understanding the timeless human needs and motivations behind security helps inform our strategy and actions for what to do about it in the current times.

Why We Need Security

The best way to start understanding our need for security is by looking at how security fits into an overall framework of human needs.

Two relevant ideas from psychology are Sigmund Freud's life instincts and Abraham Maslow's hierarchy of needs. We'll also use commentary from author Robert Greene to provide additional context on top of Freud and Maslow's principles.

In Beyond the Pleasure Principle, Freud defines two categories of human instincts: life drives, and death drives. The instinct for survival falls within life drives. We're self-motivated to preserve our own lives. In a secure and altruistic state, we're also motivated to preserve the lives of others and humanity at large.

Author Robert Greene poignantly describes this instinct for survival in The Laws of Human Nature:

Unlike any other animal, we humans are aware of our own mortality, and that we could die at any moment. Consciously and unconsciously this thought haunts us throughout our lives. We are aware that our position in life is never secure—we can lose our job, our social status, and our money, often for reasons beyond our control.

Security is an omnipresent and unshakable fixture in our minds. It's something we're seeking at all times and remain constantly vigilant about. At best, it's a low, unconscious hum in the background of our day-to-day lives. At worst, it's an all-consuming priority in an acute struggle for survival.

Conversely, we have aggressive behaviors driven by a tendency towards death and destruction — Freud's death drive. Human existence and society are a delicate balance between prosperity and aggression. The level of security we feel at any given moment can tip the scale one way or another.

Robert Greene identifies insecurity as the driver for our tendency towards aggression:

Human aggression stems from an underlying insecurity, as opposed to simply an impulse to hurt or take from others.

This idea is commonly misunderstood. It's easy to assume people do bad things because they want to hurt or steal from others. We see this misunderstanding all the time in cybersecurity. However, the real cause is a feeling of insecurity. That's an important distinction because it helps us cultivate a sense of empathy and understanding about what drives people to do harm and break the law.

We become aggressive when we believe our safety is being threatened. However, the threats our mind perceives can either be real or imagined. Robert Greene describes the feelings leading up to aggressive behavior like this:

Before any impulse to take aggressive action, aggressors are unconsciously processing feelings of helplessness and anxiety. They often perceive threats that are not really there, or exaggerate them. They take action to preempt the perceived attack of another, or to grab for things in order to dominate a situation they feel may elude their control.

Because of our intense desire for survival, our natural instincts rapidly over-correct towards aggression at even the slightest hint of a threat. To the reptilian part of our brains, no threat against our security is too small. What may appear exaggerated and overly aggressive to others seems completely normal to a person who feels threatened.

Maslow's hierarchy of needs adds a helpful layer of nuance on top of Freud's more direct ideas of life and death drives. Safety and security fit into a complex tapestry of physical and emotional needs that drive our behaviors. The hierarchy looks like this:

Needs generally have to be fulfilled in a specific order, starting at the bottom of the hierarchy. Safety falls into the foundational grouping of basic needs. For the purposes of our discussion, safety is a near direct translation for security.

Maslow was clear about the importance of safety in our lives, once describing safety as our primary motivator in life: "we may then fairly describe the whole organism as a safety-seeking mechanism."

He continued on to say that we can even value safety higher than basic physiological needs:

Practically everything looks less important than safety, (even sometimes the physiological needs which being satisfied, are now underestimated). A man, in this state, if it is extreme enough and chronic enough, may be characterized as living almost for safety alone.

That's the big idea about why security matters: there is little hope for peace (as individuals or societies) if we don't have our basic need of security met.

Bob Poston cleanly summarizes the outcome we seek as humans in a journal article about Maslow's hierarchy of needs:

The goal of consistently meeting the need for safety is to have stability in one’s life.

Safety is a foundational human drive. The objective is stability. Our entire lives revolve around it.

Unfortunately, reaching this level of security is far easier said than done. It's absurdly common to find insecurity in others and experience it ourselves. Why insecurity happens in the first place is worth a further look.

Why Insecurity Happens

Insecurity is a nuanced topic that is largely influenced by events outside our control. The events are often many levels of abstraction away from our day-to-day lives. This abstraction creates confusion and fear as our primal brains frantically search for stability.

On a micro level, events occur in our immediate vicinity — things like walking down the street or checking our email. On a macro level, geopolitical events affect the environment we live in and the actions of others — things like economic prosperity and conflicts between nation-states.

Macro-level trends and events are powerful. They can affect large groups of people, often beyond any individual nation-state. The central theme is that achieving a meaningful level of security requires economic development and growth.

Former U.S. Secretary of Defense Robert McNamara highlighted the importance of development in his book The Essence of Security:

Security is development and without development there can be no security...development means economic, social and political progress. It means a reasonable standard of living, and reasonable in this context requires continual redefinition.

Without opportunity and growth, large groups of people lose their sense of security or fail to develop one in the first place. This fuels a vicious spiral where lack of growth (development) leads to insecurity, insecurity further prevents growth, and so on. This spiral can lead to a spectrum of results, ranging from temporary, localized bouts of disorder to full blown anarchy.

In The Sovereign Individual, authors James Dale Davidson and William Rees-Mogg describe the cause and effects of anarchy:

Another important condition for anarchy to be sustained is viability or income adequacy. Individuals who lack a sufficient income to sustain life are likely either to (1) devote a great deal of effort to fighting in order to seize enough resources to survive, or (2) capitulate to another contestant in exchange for food and sustenance.

In a state of disorder, growth and development fall to the wayside as our all-consuming safety-seeking mechanism kicks in. The delicate balance is tipped towards Freud's death drives, and aggression takes over.

Unfortunately, violence and aggression are effective bargaining tools that have been used in situations of inequality throughout history. The authors of The Sovereign Individual cited economist Thomas Schelling on this topic:

Throughout history, violence has been a dagger pointed at the heart of the economy. As Thomas Schelling shrewdly put it, “The power to hurt — to destroy things that somebody treasures, to inflict pain and grief — is a kind of bargaining power, not easy to use but used often. In the underworld it is the basis for blackmail, extortion, and kidnapping, in the commercial world, for boycotts, strikes, and lockouts.”

With increasing feelings of inequality in the world (and data to back it up, even though progress is being made), people in both developed and developing countries turn towards aggression to seize resources. Robert Greene describes a somewhat grim prognosis for the situation:

Human aggression in individuals and in groups tends to emerge or heat up when we feel helpless and vulnerable, when the impatience for control and effect rises. And as increasing numbers of people and groups are feeling this way, we can expect more of this and not less in the future.

Most forms of human aggression are driven by emotions. Inequality plays a significant role in driving these emotions. The solution is development, but growth doesn't come easy. It's a challenging problem, for sure.

Economics aside, a small percentage of people are inherently evil. In the famous words of actor Michael Caine's character Alfred in The Dark Knight:

"...some men aren't looking for anything logical, like money. They can't be bought, bullied, reasoned, or negotiated with. Some men just want to watch the world burn."

No matter how much progress we make towards development and reduction of inequality, the complete elimination of evil and violent aggression is improbable.

The difficult takeaway from Greene and others is that insecurity and the aggression that results from it is here to stay. It's a problem that has been wrestled with throughout human history. We have no choice but to accept this, while also remembering that acceptance doesn't mean approval.

Instead, we should strive to make a meaningful impact within the scope of today's problems. By taking this point of view, we can focus our efforts on areas that are closer to our sphere of control. For most of us, this means technology.

Technology's Impact on History's Central Dilemma

The need for safety and stability is an enduring struggle of humanity. Threats and forms of protection against them have evolved over time, but the fundamental need has never subsided.

In The Sovereign Individual, the authors go as far as characterizing protection from violence as history's central dilemma:

Protection of life and property is indeed a crucial need that has bedeviled every society that ever existed. How to fend off violent aggression is history’s central dilemma. It cannot easily be solved, notwithstanding the fact that protection can be provided in more than one way.

This characterization is squarely in line with Freud and Maslow's principles. However, Freud and Maslow's ideas about safety and security originated from an earlier time — long before today's technology brought a new set of opportunities and challenges into our daily lives.

At the time, their ideas generally applied to physical security. Our physical security is still just as important today. However, technology has added an interesting set of nuances into the mix that that threaten our security.

In The Laws of Human Nature, Robert Greene characterized the new threats that come with technology:

The internet has also created a new and powerful weapon—cyberwar. As they always have, criminals simply co-opt technology to become more creative and elusive.

Even though war and physical violence have been declining, threats adapt to make use of new digital attack vectors. Again, from Robert Greene:

Human aggression simply adapts to the newest media and technological innovations, finding ways to express and vent itself through them. Whatever the new invention is in one hundred years for communication, it will likely suffer the same fate.

The connection between Freud and Maslow's timeless principles can easily be seen in these adapted forms of technology-enabled aggression. New threats also have the potential to creep upwards in Maslow's hierarchy and put our higher-level social, respect, and potential needs at risk.

Safety in the digital world is a bizarre contradiction of the physical safety many of us have today. Many people online live in developed countries. For the most part, we have our physical safety needs met. In Maslow's words:

The healthy, normal, fortunate adult in our culture is largely satisfied in his safety needs. The peaceful, smoothly running, 'good' society ordinarily makes its members feel safe enough from wild animals, extremes of temperature, criminals, assault and murder, tyranny, etc. Therefore, in a very real sense, he no longer has any safety needs as active motivators. Just as a sated man no longer feels hungry, a safe man no longer feels endangered.

Even though Maslow's work occurred over 80 years ago, his examples of our basic safety needs still sound a lot like they do today:

...we can perceive the expressions of safety needs only in such phenomena as, for instance, the common preference for a job with tenure and protection, the desire for a savings account, and for insurance of various kinds (medical, dental, unemployment, disability, old age).

Except, our digital lives today are different. We're arguably less safe online than we ever have been. On the internet, we can be attacked, extorted, or harassed from anywhere. Psychological warfare threatens our beliefs, institutions, and society. We're physically safe, but we're vulnerable online.

In simpler times, we used to be able to reduce the scope of inequality by containing it to our own nation-states. The thinking went like this: if everyone around us was somewhat equal, we didn't need to worry about the rest of the world, assuming we could physically secure our borders. We frequently hear variations of these nationalistic ideas today. They're not practical anymore.

In today's world, inequality anywhere creates incentives for violence. Technology enables people to act upon these incentives from anywhere. There's a reason why most ransomware attacks originate from countries where people lack opportunities for growth or common democratic freedoms are restricted.

The tension we observe comes from defending people who already have basic needs met (e.g. are working towards higher levels of needs) from those who don't. We're simultaneously raising global opportunities and standard of living to a point where everyone's basic needs are met. Progress doesn't happen overnight, and right now we are in the messy middle:

On an individual level, phenomena like the Online Disinhibition Effect can cause our online personalities to become disinhibited. Disinhibition tips our delicate balance of security and aggression towards Freud's darker death instincts. We see this happen all the time in our daily lives.

Trolling and harassment are widespread. If we become truly vengeful, violence escalates into criminal attacks and full-blown cyber warfare. And, as I wrote about in Rhetoric, Reality, and Riots, the Online Disinhibition Effect can also spill over into the physical world in unpredictable ways.

The adaptation of human aggression and crime towards technology has made cybersecurity an extremely complex and challenging field. We're still processing what all of this means and how to defend against it. One thing is certain: technology is going to be the new nexus of human aggression.

The Path Forward

All of this talk about insecurity, aggression, and violence may sound grim. There is hope for a positive outcome, though — but it requires a shift in the mindset about how we view our work.

Our mission is to provide the protection that enables development and growth. The work we do is part of a virtuous cycle of development that improves long-term safety and security. This idea is bigger than ourselves, and it's worth remembering when progress feels bleak.

Security is a foundational fixture on Maslow's hierarchy of needs. Its place in the hierarchy is to enable humanity to reach higher level needs. As Dan Farmer says, security can't be the only thing that matters:

If security were all that mattered, computers would never be turned on, let alone hooked into a network with literally millions of potential intruders.

Farmer's point addresses a larger myth about technology that we see frequently as cybersecurity professionals. As the myth goes, computers were a bad idea, and we'd be better off without them. Statements like this are usually made in jest, but there's a bit of truth in all sarcasm.

Metaphorically, we could turn off all the computers and return to simpler times. However, by doing so, we would also be cutting off the greatest engine for economic growth and development that's ever been built. And, as we now know, development is the most reliable driver of security in the long run. We need technology to help create opportunities because opportunities create better security.

To mentally prepare ourselves for the road ahead, we need to accept that conflict is going to happen and be strategic about how to defend against it. Widespread security isn't possible until basic needs are met for all individuals. Unfortunately, this is unlikely to occur in our lifetime. Until then, conflict and aggression are going to continue being issues we need to address on an ongoing basis:

There is no winning, and there is no avoidance. Erring too far towards either end of this spectrum is a fallacy. Instead, let's be prepared for conflict and use the instances we encounter to demonstrate our knowledge and character. Robert Greene says it best:

If there is an ideal to aim for, it should be that of the strategic warrior, the man or woman who manages difficult situations and people through deft and intelligent maneuver.

Since we can neither win nor avoid all conflicts, our goal is simply to be competitive in the arena. We can build our skills, tools, and influence to a point where we're as well-prepared as we can be to fend off conflict and aggression. All of us have an important role to play, even if it feels small or indirect at times.

Being strategic about how we build our skills and navigate difficult situations levels the playing field. Once our life instincts kick in, we can use our position to enable development. Put differently, we can get busy creating positive change in ourselves and as wide of a circle as we can possibly influence.

Thomas Malthus elegantly described the individual struggle against evil in a piece from 1798, An Essay on the Principle of Population:

Evil exists in the world, not to create despair, but activities. We are not patiently to submit to it, but to exert ourselves to avoid it. It is not only the interest, but the duty of every individual, to use his utmost efforts to remove evil from himself, and from as large a circle as he can influence; and the more he exercises himself in this duty, the more wisely he directs his efforts, and the more successful these efforts are...

Adopting this frame of mind is the difference between a fixed mindset and a growth mindset. We can choose to adopt a fixed mindset and believe evil is always going to exist at the level it does today. Or, we can choose to adopt a growth mindset and believe we can slowly but surely raise the level of security for everybody. You'll have to make your own choice, but sign me up for the growth mindset.

One final thought from Robert Greene, this time on the ethos for furthering civilized values:

Civilized values are not furthered if we are forced to surrender to those who are crafty and strong. In fact, being pacifists in the face of such wolves is the source of endless tragedy.

Our story can either be a triumph or a tragedy — it's still being written. Even though it's unlikely we will see the outcome in our lifetime, we can still have the satisfaction of knowing we did our part.

Thanks for reading! How did you like this article?

Loved • Great • Good • Meh • Bad