Good day friends and colleagues,
When I say CIA, I am obviously not talking about the agency but about the cyber security triad: Confidentiality, Integrity and Availability.
Boring isn’t it? It almost sounds like a pledge of allegiance to our profession. This triad has been around forever and nobody ever challenges it although our job is changing and technology use is in constant evolution.
Guess what, those are just three words that do not reflect what people are actually looking for. When I say people, I mean the ones who “pay” for security not the ones who deliver it.
Limiting ourselves to those three words just demonstrate our own fear of the unknown and of being misunderstood. By focusing on those, we lay down a formula and we try to communicate professionalism by means of formalizing the objectives we are trying to attain. But those three objectives are far from sufficient; the world is changing, so our challenges and three adjectives are not exactly a call to action right?
When people talk about security, they actually put a label on their underlying expectation which is to be protected against adverse situation that might disturb in or prevent them from going on normally with their day to day life while leveraging technology as much as possible to make one’s life easier.
Maybe, it is time we looked differently at those three letters, at our profession and at our way of doing things. I have no doubt that what we are doing is of outmost importance and will take the central stage of many reforms in the future on both the political and social side but I think we have to collectively improve to be able to play with the big boys.
Maybe we should engage more on a personal level with those who are actually looking for our services and solutions?
If we love what we do, engagement is the only way to go; else, it’s investing a lot of time and effort to satisfy oneself which is not exactly aligned with “the greater good”. It is perfectly fine if you are Lex Luthor but totally selfish otherwise.
So here is my simple proposal, ENGAGE!
Change the meaning of the triad for you and for the people you care about. To get better at your job, you must first Consider their expectation (instead of jumping to the solution), Investigate acceptable outcomes and resolution path (no solution yet) and then Address their fears and problems by delivering practical advices and solutions.
Isn’t that a sounder mission for us? Isn’t that a better call to action? What do you think?
Best regards,
Martin Dion
N.B.: Special thanks to Joseph Maalouf for his inspiring coaching
Kudelski Security Research 