Unlocking CyberResilience via ancient wisdom.

In an era where complexity, volatility, and constant change define our world, the realms of philosophy, leadership, and cybersecurity intersect in surprising ways.

In several interviews and podcasts I was asked about some principles CISO’s (or actually any manager) can apply to make their journey a bit more comfortable (ehh). Over the years I’ve noticed to fall back on three major philosophies that I’ve more or less incorporated (still refining every day) in my way of working. I’ve tried to summarize them and hope you feel inspired to read them further and take on board what is usable. Also curious what your favorite mechanisms are. Feel free to add them in the comments section. Here goes:

The principles of Stoicism, an ancient philosophy emphasizing rationalism and self-control, provide a roadmap for navigating the turbulent landscape of cybersecurity and daily life. As we explore the profound teachings of Marcus Aurelius and the Stoic principles he employed, we uncover insights that extend beyond historical contexts, resonating with modern leadership practices and security strategies. Simultaneously, embracing the Infinite Game Theory offers a paradigm shift towards continual adaptation and resilience in the cyber world, transcending the focus on finite victories. Furthermore, the concepts of VUCA (Volatility, Uncertainty, Complexity, Ambiguity) and BANI (Brittle, Anxious, Non-linear, Incomprehensible) shed light on the intricate nature of global systems, providing tools for strategic navigation. The amalgamation of these philosophies, theories, and frameworks presents an interdisciplinary approach to management, where wisdom from the past and innovative thinking coalesce to guide us through the ever-evolving challenges of the present.

Let’s dive into each one a little bit:

1. Harnessing the Strength of Stoicism

Stoicism, an ancient philosophy, advocates for control over one’s emotions and actions. Stoicism is a school of philosophy that was founded in Athens by Zeno of Citium in the early 3rd century BCE. It’s not attributed to a single inventor or idea but rather to a group of philosophers who developed and expanded upon its principles.

Zeno’s teachings were heavily influenced by the ideas of Socrates and the Cynics, and they emphasized rationalism, self-control, and virtue. Other significant Stoic philosophers, such as Epictetus, Seneca, and Marcus Aurelius, further developed and spread Stoicism throughout the Greco-Roman world. I personally really like the writings of Marcus Aurelius.

Marcus Aurelius, Roman Emperor from 161 to 180 CE, is one of the most well-known Stoic philosophers. His Stoicism wasn’t merely a theoretical exercise; it was a practical philosophy he applied to his daily life and his rule as emperor and conqueror.

Meditations

Marcus Aurelius’s personal philosophical journal, known as “Meditations,” remains one of the most admired works of Stoic literature. Written in Greek during his military campaigns, it is a series of reflections and exercises in Stoic philosophy. Rather than a systematic exposition of Stoic philosophy, “Meditations” is a personal document meant to guide his own conduct and self-improvement.

Key Stoic Themes in Marcus Aurelius’s Writings

• Virtue and Wisdom: Marcus Aurelius emphasized living according to reason and virtue. He believed that virtuous living was in accordance with nature and the rational order of the universe.
• Duty and Responsibility: He often reflected on his role as an emperor, focusing on his duties and the responsibilities that came with his position. His Stoicism informed a sense of public service and ethical governance.
• Control and Acceptance: A central tenet in his writings is the distinction between what one can control and what one cannot. He urged acceptance of things beyond one’s control and focus on one’s own behavior and reactions.
• Mindfulness and Present Moment: Marcus Aurelius often wrote about the importance of being mindful and present in the current moment, not being swayed by past regrets or future anxieties.
• Compassion and Understanding: Even as a ruler, he emphasized understanding and compassion towards others, recognizing the shared human condition.

Marcus Aurelius’s Stoicism has left a lasting impact. His reflections in “Meditations” continue to be read and respected, not only for historical and philosophical value but also for personal growth and ethical guidance.

In modern times, Marcus Aurelius’s Stoicism has found resonance in leadership teachings, self-help literature, and even areas like cybersecurity, as discussed earlier, where his emphasis on control, acceptance, and duty can be applied to the challenges faced in a complex and evolving field.

His practical and humane approach to Stoicism has made Marcus Aurelius a timeless figure, demonstrating that philosophical principles can guide everyday life and governance.

How to apply Stoicism to our daily cyber life:

In cybersecurity, Stoicism teaches us to focus on what we can influence while accepting what we cannot. By applying stoic principles, professionals can respond to threats with a calm and methodical approach. Recognizing that the cybersecurity landscape is always evolving, stoicism encourages the practice of mindfulness and preparedness. It’s about developing a robust inner core that can withstand turbulence, prioritize efforts, and implement effective strategies without panic.

• Emotional Resilience: Stoicism emphasizes control over emotions. In cybersecurity, this translates to maintaining calm under pressure, particularly during a breach or attack, and responding with a well-thought-out strategy or playbook instead of panicking.
• Acceptance of What Cannot Be Controlled: Understanding that not all elements of cybersecurity can be controlled allows for a focus on areas where control and influence are possible. This may involve robust protection and preparation for known threats while accepting that new, unforeseen threats may emerge.
• Continuous Preparedness: Stoicism teaches us to prepare and be mindful of potential challenges. In cybersecurity, this means ongoing training, threat monitoring, and developing response plans for potential breaches.
• Ethical Decision-Making: Applying Stoic ethics means acting with integrity and responsibility. In cybersecurity, this ensures that data privacy is respected, and security measures are implemented thoughtfully.
• Long-Term Perspective: Stoicism encourages us to look beyond immediate challenges and focus on the bigger picture. In cybersecurity, this means creating sustainable security policies that adapt to the evolving landscape rather than short-term fixes. Also having a clear vision where to go- and grow to keeps teams on the right track.
• Emphasizing Security Culture: Building a culture where security is everyone’s responsibility aligns with Stoic principles of community and wisdom. Regularly educating staff about the importance of secure practices helps create a more resilient organization.

These practices, grounded in Stoic philosophy, can guide cybersecurity professionals in developing a resilient and adaptive security strategy. They allow for a composed and methodical approach to the ever-changing and complex world of cybersecurity, helping to navigate it with wisdom and strength.

2. Embracing the Infinite Game Theory in Cybersecurity

Infinite Game Theory is a concept brought forth by James Carse in his book “Finite and Infinite Games.” Simon Sinek further popularized it in a business context. Unlike finite games, where the objective is to win, infinite games are played with the understanding that the game never really ends. The primary focus is to keep playing and adapting.

In the context of cybersecurity, Infinite Game Theory can be seen as a philosophy that recognizes the ever-evolving nature of cyber threats and the need to continually adapt and grow rather than merely winning individual battles. Winning is impossible anyway in asymetric warfare where the adversaries have much more resources and time at hand.

The Concept of Infinite Game

The main characteristics of an infinite game include having no defined rules, no clear competitors, and no definitive ending. Players in an infinite game focus on improving and adapting rather than defeating a specific opponent. The game’s continuity becomes a goal in itself.

Applying Infinite Game Theory to Cybersecurity and Daily Life:

• Ongoing Adaptation: Emphasize continual learning, knowing that the cyber landscape always changes, and new understanding is constantly needed.
• Beyond Winning Individual Battles: Focus on building a resilient system to face any threat, realizing that new challenges will perpetually emerge.
• Long-Term Vision: Create a long-term strategy that focuses on continuous improvement, resilience, and sustainability, transcending immediate victories.
• Collaborative Mindset: Encourage information sharing, collaboration, and collective defenses, fostering an environment of cooperation rather than competition.
• Align with Core Values: Act with integrity and consider the broader impact, ensuring that cybersecurity strategies align with the organization’s ethical principles.
• Invest in People and Culture: Recognize that success in cybersecurity involves more than technology; it’s about people, culture, and leadership, requiring investments in training, awareness, and fostering an adaptive and resilient culture.

By adopting Infinite Game Theory, cybersecurity professionals can transcend traditional defensive mindsets. This approach advocates for a dynamic and collaborative strategy that recognizes the complexity and continuous evolution of the cyber world. It’s a path towards a more sustainable, effective, and humane approach to cybersecurity, reflecting a wisdom that can be applied not only in the digital realm but also in navigating the broader challenges of life.

3. Navigating cyber complexity with VUCA/BANI

The complex nature of our global system, illustrated by events like the COVID-19 pandemic, the war in Ukraine, extreme weather conditions, uprising of populism/extremism, A.I., etc, resonates with the principles of VUCA and BANI. What can we apply from these principles to cyber?

VUCA

VUCA is an acronym that stands for Volatility, Uncertainty, Complexity, and Ambiguity. It originated in the late 1980s within the U.S. Army War College to describe the more volatile, uncertain, complex, and ambiguous world that emerged after the Cold War. Here’s a breakdown of its components:

1. Volatility: Refers to the nature and speed of change, and the unpredictability and instability in a system.
2. Uncertainty: The lack of predictability and the unknown aspects of the future.
3. Complexity: The multitude of interconnected factors, information, and variables that can be difficult to process and understand.
4. Ambiguity: Lack of clarity and the existence of multiple meanings, causing confusion in understanding the present situation.

VUCA has since become a common term in business and leadership, describing an environment that is challenging to manage due to its unpredictable and complex nature. It calls for agility, strategic vision, and adaptability in decision-making.

BANI

BANI is a more recent concept and stands for Brittle, Anxious, Non-linear, and Incomprehensible. It was introduced by Jamais Cascio, a futurist, as a framework to describe the chaotic world we find ourselves in today, especially with the influence of technology and globalization. Here’s what the components mean:

1. Brittle: Systems that seem strong but can break suddenly and unexpectedly.
2. Anxious: A continuous state of worry and stress due to ongoing volatility and complexity.
3. Non-linear: Unpredictable and disproportionate cause-and-effect relationships
4. Incomprehensible: A level of complexity so profound that it becomes impossible to fully understand or predict.

BANI aims to describe a world that is not only uncertain and complex but also fraught with anxiety, fragility, and incomprehensibility. It’s a more nuanced view of our present environment, taking into account the emotional and psychological aspects.

In summary, while VUCA originated as a military concept and has been embraced by the business world to describe challenges in leadership and strategy, BANI provides a more contemporary and nuanced perspective on the chaotic and unpredictable nature of our modern world. Both frameworks are tools for understanding and navigating complexity, but BANI tends to reflect a world that’s not only complex but also deeply unsettling and difficult to grasp.

Navigating VUCA/BANI: Best Practices:

1. Agility: Being flexible and adaptable to rapidly respond to changes. Empower your teams to act fast. Rely more on intuition in stead of extensive business cases.
2. Strategic Vision: Aligning efforts to long-term goals and having a clear understanding of the bigger picture. Giving your teams a clear goal on the horizon keeps them on the right track. Strongly connect this vision to purpose.
3. Resilience: Building robust systems and mindsets that can withstand shocks and recover quickly. Exercise the continuity muscle!
4. Continuous Learning: Encouraging ongoing education, upskilling, and awareness of the ever-changing landscape. Fail fast, get up and do better!
5. Collaboration and Communication: Enhancing teamwork and information sharing to build trust within organizations. Build your network of trusted experts and don’t hesitate to reflect your ideas.
6. Ethical Leadership: Leading with integrity, compassion, and clear ethical principles.
7. Innovative Thinking: Looking beyond traditional solutions to complex problems and encouraging creativity.

TL;DR: These three principles and practices (Stoicism, Infinite Game Theory and VUCA/BANI) provide organizations and (cyber)leaders with the tools needed to navigate the complexities of our interconnected and rapidly changing world, whether in cybersecurity or broader organizational challenges.

Short version: focus on what you can influence, hyperfocus on yourself and self-discipline. Cultivate a learning environment, empower, fail fast and lead by example. 1% improvement each day is enough. Align all you do to the outspoken long term cyberresilience vision and purpose.

Change is the only constant. By integrating these practices, you may develop more robust, flexible strategies that help you embrace even the most unforeseen challenges. At least, that’s my humble experience.

References:

1. For Harnessing the Strength of Stoicism:

• Aurelius, M., 2003. Meditations. Penguin Classics.
• Robertson, D., 2013. Stoicism and the Art of Happiness. Teach Yourself.
• Hadot, P., 1998. The Inner Citadel: The Meditations of Marcus Aurelius. Harvard University Press.
• Sellars, J., 2006. Stoicism. University of California Press.
• Long, A.A., 2002. Epictetus: A Stoic and Socratic Guide to Life. Oxford University Press.
• Irvine, W.B., 2009. A Guide to the Good Life: The Ancient Art of Stoic Joy. Oxford University Press.

2. For Embracing the Infinite Game Theory in Cybersecurity:

• Carse, J.P., 1986. Finite and Infinite Games. Free Press.
• Sinek, S., 2019. The Infinite Game. Portfolio.
• Nissenbaum, H., 2009. Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford University Press.
• von Solms, R., van Niekerk, J., 2013. From Information Security to Cyber Security. Computers & Security, 38, pp. 97–102.
• Zetter, K., 2014. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. Crown.
• Sinek, S., 2014. Leaders Eat Last: Why Some Teams Pull Together and Others Don’t. Portfolio.

3. For Navigating Cyber Complexity with VUCA/BANI:

• Cascio, J., 2020. Facing the Age of Chaos. Medium. Available at: https://medium.com/@cascio/facing-the-age-of-chaos-b00687b1f51d [Accessed 13–8–2023].
• Bennett, N., Lemoine, G.J., 2014. What VUCA Really Means for You. Harvard Business Review.
• Heifetz, R., Grashow, A., Linsky, M., 2009. The Practice of Adaptive Leadership: Tools and Tactics for Changing Your Organization and the World. Harvard Business Press.
• Stiehm, J.H., Nicholas, L.J., 2002. The U.S. Army War College: Military Education in a Democracy. Temple University Press.
• Ramo, J.C., 2016. The Seventh Sense: Power, Fortune, and Survival in the Age of Networks. Little, Brown and Company.