Posted on October 10, 2022
Story Snafus: Plot Armor
One of the unfortunate side effects of learning how to write is that some of those lessons stick and bleed into how you view media. These range from the mundane (sentence structure, slight character or plot inconsistencies), the moderate (flat characters, overuse of cliches), and the extreme (deus ex machina, unlikable protagonists). It drags you out of the story when you run out of eyebrows to quirk at the issues you see, especially if you then spend the next week-plus seething over how you could have done it better. The one that frustrates me the most? Egregious use of plot armor.
For those with too much sense to spend their time delving into story mechanics, plot armor is “when a main character’s life and health are safeguarded by the fact that he or she is the one person (or one of several) who can’t be removed from the story.” When you need a character to accomplish something later in the story, you can’t very well kill them off in the beginning. On the other hand, if you don’t have them face any challenges along the way, they are boring enough that there’s no point in following their journey. Thus, plot armor. Every character has it, to an extent—so long as the author needs that character to do something, they have to be able to perform that task. Where the issue lies is when that authorial protection becomes grossly apparent.
Like for many things, the worst recent example I can think of comes from the last three main Star Wars movies (episodes seven, eight, and nine). You have several examples to pick from, but my haterade flavor of choice is Rey in The Force Awakens. Up to the start of the movie, Rey spent her entire life scavenging scrap and hitting people with a stick. By the end of the movie (which we have no reason to think took longer than a few days), she flies multiple spacecraft she’s never seen before, escapes captivity multiple times utilizing abilities she’s had no training in, and wins a lightsaber duel against someone with years of experience while never having touched one herself. This dips into Mary Sue territory (another trope for another Wandering), but the two feed off each other in a story-killing form of parasitic symbiosis.
Why does it matter if the main character succeeds? That’s the wrong question. What matters is how that character succeeds. Because Rey consistently shows she can overcome any obstacles with zero training or explanation, nothing the story throws at her matters. This leaves the audience in a perpetual state of disbelief because the writers put no effort into making the challenges against her appear formidable or realistic when matched up against her plot armor. Why would I let myself feel any suspense or care for the character when I know that she’ll just manifest whatever power she needs to win at the exact time she needs it? There’s a reason most video games with cheat codes turn off achievements if you use them—at that point, you haven’t earned anything.
* * * Spoilers ahead for The Rings of Power * * *
All of that brings me to episode six of The Rings of Power. My rage tanks were full of righteous indignation as I watched a bunch of peasant farmers and a single elf somehow take down an entire company of battle-hardened orcs. The fury came to a crescendo as somehow the injured child of the town healer not only holds his own against multiple armored combatants, but triumphs over them. I prepared to roll my eyes hard enough to give myself whiplash when the writers revealed their clever little trick. Turns out the peasant farmers weren’t wildly successful against orcs—they just managed to slaughter a bunch of other peasant farmers being led by a few orcs.
Not only does this scene convey a palpable sense of the characters’ horror at killing yesterday’s neighbors, it leads perfectly into the realistic outcome. The good guys got lucky with their trap at the tower, but when it’s the orcs’ turn, they crush the good guys. And of course they do! That’s what you’d expect when a battle-tested, armored force goes against people who’ve never fought before in their lives. Granted, there’s still plenty of plot armor to go around (assuming that shoulder wound doesn’t get infected), but at least this conveys a sense of consequence. It’s all well and good to stand up and fight against evil, but if there’s no believable reason why you should succeed, then the right answer is that you don’t. Otherwise we end up with the last Star Wars trilogy, and no one wants another one of those.
Posted on September 25, 2022
Joining the Military: A Tale Told in Three Parts
Our society has an unfortunate tendency. We expect children on the cusp of adulthood to know what they want to do with their lives before graduating from high school, regardless of further need for emotional and maturity development. Occasionally, however, a few get lucky. I consider myself in that latter category, but it has taken me an additional fourteen years to understand it. While I only signed on the dotted line once, I have “joined” the military on three separate occasions. With each joining, I grew closer to knowing why.
The first time I joined the military came from my obsession with reading. Tired of constant trips to Barnes and Noble with his 6th grader, my father dusted off a box of his old books from the attic and cut me loose. From that trove came one that changed my life—Fight like a Falcon by Philip Harkins. In it, the main character is an aimless teen who meets a cadet from the Air Force Academy. The teen then turns his life around and gains entrance to the Academy, then experiences his doolie year. I was hooked.
After finishing the book, I happily informed my father I would attend the Air Force Academy and be an officer in the Air Force. Having endured the weekly changing of “what I want to be when I grow up” dreams from multiple children, my father patted me on the head and promptly forgot about it. But the seed was planted and took root. From 6th grade on, the Academy was the only college option I considered. Even after an initial rejection, I kept at it until gaining entrance with the Class of 2013.
When asked why I wanted to join the Academy, the answer I always gave was that I wanted to do something different. Only a cousin had served since the draft in WW2, and none of my friends interested in it. I wanted something beyond the usual nine-to-five gig (joke’s on me, I’ve never had a duty day start later than 0730). This longing for the unique sufficed to drive me through seven years of yearning and four years at the Academy.
The second time I joined the military was when my initial commitment expired. My five years came and went while I was stationed in Germany, working for the USAFE-AFAFRICA/A6. In many ways, the job was everything I had wanted to avoid—I worked in a cubicle farm, spending most of my time on a computer typing emails and plans. The other part of my job, however, was going TDY to work with our Allies and Partners across Europe and Israel. That experience is what made me join again.
I spent my first five years firmly at the tactical level. It had many rewards, but kept my scope so narrow that I allowed the bureaucratic grind of life in the Air Force to jade my experience. I actively considered getting out when my commitment expired. However, what I gained from working with our partners in the EUCOM AOR—Israel and Ukraine, in particular—was an expanded perspective.
I went on dozens of TDYs to these two countries and spent days planning major exercises with our partners. I saw firsthand what it meant for a country to plan for its survival in what my Israeli friends often called “a rough neighborhood.” While the War on Terror had been ongoing since well before I initially joined, Al Qaeda and other VEOs never threatened America’s survival. Israel and Ukraine had to deal with an existential threat every day, one we have seen born out by Russia’s recent invasion. This took my initial reason of wanting to do something different and gave it a framework. Now I was not joining just to be different, but to be different for a purpose: defending a way of life I hold dear.
The third time I joined the military was when I cross commissioned into the Space Force. While I valued my time in the Air Force, I believed the Space Force offered me something more. My final year on the A6 staff had me standing up a brand new Defensive Cyber Operations cell for USAFE-AFAFRICA, giving me a taste of how satisfying the act of creation can be in an organization. Now, I had the ultimate opportunity in front of me: jump into the chaos of standing up the first branch of service in seventy-two years and create something new. Not only new, but something that would leave an indelible legacy on the nation. My every action could help shape how a Guardian seventy-two years hence found his or her purpose.
Recognizing that led me to better understand my previous two reasons for joining. Was joining the Space Force doing something different? Of course—no one in the world had ever been a part of such an effort until we did so. Was it part of defending our way of life? Absolutely, and it will continue to do so well past when I eventually retire. But more than that, it gave specific focus to the How of my Why. Here was a purpose that no bureaucratic slog could detract from. The impacts I make now can resonate in a way I find hard to imagine finding anywhere else, and that inspired me to go all in.
I have since committed myself to a full career in the Space Force. Whether that’s twenty years or forty remains to be seen, but this is the path I have carved for myself. What else could I look back on after twenty-plus years of effort and find a similar level of fulfillment and purpose? And throughout it all, I will still fulfill that initial wish that my 6th grader-self recognized without understanding—spending my finite time on this earth in a different way, one with meaning.
Posted on September 11, 2022
A Short Repaste
I struggle with long sentences. Speaking them, writing them, thinking them. Trying to limit my verbosity ends poorly. So here is my nth attempt to do so. Each sentence here will be chopped in half. I warn you now, this will not be enjoyable. I will struggle through it. I will gnash my teeth all the while. But maybe at the end, I will learn something.
Which is worse: ignorance of one’s flaws, or knowledge with a failure to act upon them? We can all place that one acquaintance ignorant of their intolerable behaviors. Likewise, we can all identify a struggle all our own. Severity has an impact. So does circumstance. My longwindedness is less problematic on a non-existent readership than it is in person. Where to draw the line?
I can make a case for both. Let’s start with ignorance. It can break down in two ways. First, that born of pride. Second, that born of laziness. Pride prevents us from accepting what introspection reveals. Laziness prevents us from introspection at all. Of the two, pride is the greater sin. It willfully subsumes personal growth on pride’s altar. Often that comes at the expense of others around us. Always it comes at the expense of our own wellbeing. Laziness shows we do not care. Apathy is ugly. It worms its way inside and festers. It crumbles dreams and poisons relationships. Ignorance from pride or laziness is intolerable.
Now for failing to act on one’s known flaws. This breaks down in three ways. First, again, is pride. Second, again, is laziness. Third, though… third is fear. Fear is often at the root of laziness in this case, just as pride is at its root. We fear change. We fear the effort we know it takes to grow. We fear losing time to a pursuit with uncertain outcomes. All these fears coalesce into stagnation. A comfort zone is comfortable because one need not move. There is no fear there, because there is no growth. And because there is no growth, there remain flaws.
Which is worse: ignorance or willful negligence? The latter, for that we have greater control over. There are always blind spots to feed ignorance. We can work on these, but never fully resolve them. We can always fight our fear. We can learn to embrace it, let it pass through us. Only then can we make progress. One word at a time.
Updated on September 4, 2022
Lightyear: To Infinity, but Not Quite Beyond
I am a huge fan of science fiction, anything involving the concept of “rangers,” and cats. Pixar’s new Lightyear movie could not have targeted my niche demographic more if the intro crawl had said “For Jake.” And to the filmmaker’s credit, I did have a good time with it. It doesn’t quite hit the upper tier of Pixar movies, but Lightyear leaves some other recent installments in the hyperspatial dust.
***Spoilers Ahead***
I plan on covering a specific point, so I’ll breeze over most of my likes and dislikes. On the negative side, Evil Buzz as the villain didn’t quite work for me. The deus ex machina of him happening across a massive ship with a robot army in the far future that he somehow turns into a time machine gave me acid reflux. I get what they were going for. Showing Buzz the dark place where a focus on the mission over relationships might take him was a good thought. It’s the backstory supporting the villain that needed polish.
The star of the movie is obviously Sox. I now exist in a darker world, knowing I was born decades too soon to have a Sox of my own. The amusement of an artificial therapy cat piloted by AI advanced enough to solve a nigh-impossible mechanical and chemical engineering problem while also managing to distract himself with a built-in laser pointer cannot be measured. Where I credit the filmmakers most, though, was nailing to tranquilizer dart gag *twice* with the same “I bought you five minutes” line. I can say with absolute certainty that Evil Buzz stomping on his Sox was my most traumatic film experiences in recent memory.
Now, onto the point that made me want to write about Lightyear at all. Evil Buzz has a robot army at his beck and call that mostly serve as unremarkable cannon fodder. However, the first robot Buzz faces breaks the mold by getting significant solo screen time. The broken machine—who we see get lobotomized by a harpoon—claws its way back from virtual death to track Buzz down, scene by scene. The audience is led to believe this robot has significance. Why else would we see three-plus scenes focusing on just this one robot as it follows Buzz’s trail like a futuristic bloodhound? Then finally, the moment of delivering on that unexplained promise comes. The robot sees Buzz and crew fleeing from a host of other robots and boosts off in pursuit.
What comes next? Did the aforementioned lobotomy do the obvious thing and rewire the robot to want to help Buzz instead? Did it come with fiery vengeance and singlehandedly destroy their escape craft? Did it do anything of note? Of course not. The robot got in front of Buzz’s ship and gets run over. Then it falls in line with the rest of the cannon fodder with no discernible difference aside from its missing arm.
Why spend time talking about this virtually meaningless point from a movie that will soon fade from the collective media consciousness, you ask? Because promises are important.
I have written one novel and have half a chapter to go before finishing the draft of another. One of the areas I struggle with the most is setting up and delivering on promises across the story. That issue comes from writing these two novels as a gardener (aka seat-of-the-pants, stream of consciousness) instead of an architect (aka an outliner). When you plan your story out from foundation to crenelations, you can draw clear lines from promises to delivery at the outset, making it easier to form those connections in the reader’s mind. As a gardener, you have to look back on an overgrown patch of competing ideas and try to weed out the rotten bits without severing whatever connections do exist, all while growing new ones as necessary. This is, to put it in a word, difficult.
What I saw when I watched that robot amount to nothing was a visualization of my own problems. I can think of multiple unsatisfying promise fulfils in my first novel off the top of my head (thus why it’s on hold at the moment). The novel currently in draft has even more. Telling a story is a contract between the storyteller and the audience. The audience agrees to offer up a portion of their finite time on this world, and the storyteller promises to entertain them. That promise of entertainment then breaks down into countless other promises and fulfilments over the course of the story (good triumphs over evil, the hero/heroine gets the girl/boy, etc). If the storyteller fails to execute on those tactical level promises, they’ll never accomplish the primary objective—entertaining the audience.
Lightyear manages to entertain in a myriad of ways and fulfills plenty of promises. But like an unexpected tranquilizer dart shot from the mouth of a standard-issue artificial therapy cat helping its patient escape lawful confinement, the ultimately insignificant robot brings me down.
Updated on August 21, 2022
The Mortal Mercenary – Teaser
Writing my first novel was both a fantastic and sobering experience. On one hand, I accomplished a lifelong goal and told what I think is a fun story. On the other, I realized after I had “finished” just how rough the product was and how much fine tuning it would need to be palatable. Thus, it sits in the trunk for now as I try to take lessons learned from writing it onto my next project.
One of the areas I know it needs work is the intro. I wrote an entire prologue that has nothing to do with the story writ large and needs to be cut. That said, I absolutely loved this bit and don’t want it to wither away. So here it is in all its glory! I hope you enjoy it.
I took a deep breath, adjusted my polo shirt, and prepared to do battle with forces that had preyed on humanity since before our recorded history.
“Cucumber water, sir?” I asked.
The robed fellow sitting in the plush chair in front of me didn’t bother to look up from his tablet as he raised his hand. I took a glass from the tray I carried and placed it in his upraised palm, making sure the glass was the one with three slices floating in it. He took it without a word of thanks, dismissing me with a flick of his other hand as he continued reading.
I made my way towards the employees only area of the high-end spa, dropping the mandatory cheer from my aching jaw as soon as I pushed through the swinging doors. I checked my watch—according to the schedule Jeeves had lifted off their server, my target’s appointment was in four minutes. Plenty of time to tie up the last loose end before execution. I took a clipboard off one of the nearby desks and stepped through another door.
“Three down to the left,” I said to myself, counting doors along the back hallway attached to the VIP treatment suites. I came to a stop in front of it, confirming the name on the attached whiteboard before going inside.
A man dressed in the same spa uniform as me stopped putting new sheets on the massage table and glanced in my direction. “Who are you?” he asked.
“New hire,” I said, holding up the clipboard. “The boss said I’m supposed to take Mr. LeYensa’s servicing today.”
“That can’t be right,” the employee said, “I’ve been Tomas’s masseuse for over a year.”
I shrugged. “Don’t know what to tell you. Take it up with the boss if you feel like it.”
“Let me see that clipboard,” he said, coming around the table. I handed it over and stepped slightly behind him.
“Wait,” he said, his confusion deepening. “This is the potluck sign-up sheet. What are you playing at—”
Whatever else he had to say got cut off as I reached up and put him in a chokehold. He flailed his arms and tried to break my grip, but the hold was tight. I hummed to myself and counted out the seconds, slowly bringing him down as I hit ten. By twenty seconds, he was completely limp and laid out on the floor. I eased off the choke—no one was paying me for him, after all, and clean-up on mortals is always messy. He started coming back around as blood rushed back to his head, but a drop of wyrm venom on his lips settled him back down. I dragged him into the corner room’s tanning bed and tossed an extra sheet over him to keep him hidden. He’d wake up in an hour with a splitting headache and no idea what had happened the past day or so.
Another check of the watch showed I had sixty seconds to go. I finished draping the sheets over the massage table, dimmed the lights, and stepped out the front entrance to greet Tomas.
“Right over here, sir,” the receptionist said, pointing Tomas down the customer hallway towards me before returning to her desk. I plastered the mandatory cheer back on my face and greeted him, noting that for someone supposedly seen by the same man for a year, he didn’t seem to recognize a stranger in his normal masseuse’s place. I suppose we all look alike to his type.
Once we both entered, I closed the door and coughed to cover the sound of flipping the lock.
“The usual,” Tomas said, starting to strip off his robe. He made it halfway out before he hesitated. He shook his head once, then twice, before reaching out to steady himself on the table. I crossed my arms and leaned against the wall, watching as his symptoms worsened. His eyes jerked around the room, eventually coming to rest on me just as his legs buckled beneath him.
“What…is happening…to me…” he muttered, fighting against his numbing tongue.
“Nothing too extreme,” I said. “Just a sedative I slipped into your water.”
“You…?” he said, squinting to try to bring me into focus. “I will…rip your heart…out.” He bared his teeth, showing me two fangs extending downward where a human would have incisors. To his credit, he did manage to make it to his feet and take a stumbling step towards me before face planting on the teakwood floor.
“Normally, you would,” I agreed, making my way over and squatting in front of his still open eyes as his breath labored in short gasps. “But then, normally a sedative wouldn’t have this effect on a vampire. That’s why I laced it with holy water. Gives it a nice kick.”
Tomas tried to snarl, but it came out as a wet gurgle instead.
“Don’t worry, you won’t notice a thing when you go unconscious in a minute or so. But before you do, I have to read something to you.” I pulled out my phone and gave him a what-can-you-do grin. “Part of the contract. I’m sure you understand.” His eyes widened as he pieced together what must be happening, but the sedative had spread too far for him to do anything else. “Tomas LeYensa, the Los Angeles coven finds you guilty of theft, blood corruption, and sedition. Let death take you from your eternal life.” I put the phone away and gestured to myself. “I’m here for that second part.”
Fury filled Tomas’s eyes before they creaked shut like a struggling garage door. I gave it another minute to be sure, then stood and nudged him with a toe. His limp body didn’t react, so I started whistling and bent down to put him into a fireman’s carry. I hit the chorus as we reached the tanning bed. “Dirty deeds…” I sang off-key, dumping the vampire onto the bed. “Done. Dirt. Cheap.” I dropped the lid and plugged in the machine before putting a minute on the timer and hitting the start button. I tapped out the next verse of the song on the lid as the scent of brimstone filled the room, periodically checking through the gap to make sure Tomas was getting an even coat.
The timer dinged, and I lifted the lid up to see a vampire-shaped ash pile pouring out of Tomas’s spa robe. I picked up the robe and carried it over to the trashcan, emptying out what was left of the vampire before snapping the robe a few times to clear off the rest. Then I scooped out the ash from the tanning bed and dumped it as well, making sure there was no trace left. That done, I grabbed the unconscious masseuse and propped him up in one of the room’s chairs like he had been napping, before grabbing the trash bag with Tomas’s ashes and heading for the door.
My name is Zeke Hunter, and I’m the Mortal Mercenary. From the arcane to the profane, I take care of any of your supernatural needs for the right price. Vampires vanquished, ghouls garroted, and specters spaced or your money back—minus expenses, of course. But the most important thing you need to know about me is this:
I love my job.
Posted on July 31, 2022
Individualism versus Community
As an American, I was raised on a steady diet of individualism and what it brings to the world. At the same time, my upbringing in the Church of Jesus Christ of Latter Day Saints highlighted how community can and does benefit everyone involved. Unfortunately, these two forces exist in opposition. Where is the line drawn between them? More specifically, at what point do the costs of individualism outweigh its benefits?
As with most dichotomies, both sides carry unique pros and cons. Individualism is often associated with creativity, a push for change or growth, and a certain vibrancy hard to find elsewhere. On the other hand, community brings stability and security, along with the comfort of belonging. I’d hazard a guess that we all agree both sets of qualities are worth pursuing. That said, both sides of this equation also have their darker elements. When individualism is taken to the extreme, you get the Unabomber. Community taken to the extreme means a Jonestown. The sweet spot lies somewhere in the middle
Finding that balance is a never-ending assessment carried out within a community. I stress that it is the community that must decide on its accepted level of individualism. After all. the community owns the ultimate power over the individual with the threat of ostracism. This creates an interesting balancing of scales, because the individual can threaten the whole structure of the community through a single action. That particular equation generally goes one way—an individual can have an outsize negative impact far easier than a positive one. Mass shooters, suicide bombers, and the who guy who poisoned random pill bottles can change things far more dramatically for a community than a single positive action.
The battle between individualism and community boils down to two facts. The long term favors the community because of its stability and its ability to drive out individuals that threaten the status quo beyond accepted levels. Short-term favors the individual, whose actions can sometimes cause enough disruption to rock a community and force change that might otherwise not occur. If the action is destructive enough, the community might fracture along fault lines or newly discovered tribal loyalty. The community’s ability to resist this depends on its resiliency, which I think stems from its tolerance of individualism within its structure. A community willing to accept the eccentrics and oddballs within its circle is one more ready to ride out seismic change brought about by the same individuals.
What is the point of this diatribe? It’s me trying to understand potential solutions to the excessive polarization that my country faces today. I have no studies or evidence beyond my own observations from which to draw conclusions, but I feel that the rampant individualism at the heart of most Americans was always destined to end this way. The increased Balkanization of American community driven by extremists on the fringe threatens the stability that community should offer its citizenry. As that overarching community gets torn into smaller and smaller pieces, what security it once offered is sacrificed on the altar of individualism.
America needs a reset of its community. This goes beyond Republican versus Democrat, minority versus white, or any other arbitrary difference we might assign to fellow Americans. It’s more fundamental than that. It’s the willingness to go out of one’s way to help a neighbor. It’s the willingness to take joy in another success, even at the expense of one’s own. It’s the desire to see a more inclusive “us” instead of focusing hostility on a “them”.
Let’s strive for a world where it’s easier to have the word “we” on our lips instead of “I”.
Posted on July 18, 2022
Cybersecurity and the Infinite Game
Cyberspace. The infinite game. Sounds like a pitch meeting for the next Tron meeting. Alas, it’s just another ham-fisted attempt to glean Sec+ CEUs via blogpost. Today’s stretched metaphor will crib from Simon Sinek’s book The Infinite Game and the concept of, well, infinite games.
Let’s start with defining a finite game. This is the easiest to grasp as it comes up all the time in our lives. In it, you have defined roles of who is playing, what the rules are for the players, and what the end state looks like. Chess is an example of a finite game: two players, pieces can only move in prescribed ways to agreed upon effects, and the game ends either when one side checkmates the other or a stalemate is reached where no checkmate is possible. Easy peasy.
Infinite games, however, throw all that out the window. They have no set number of players. In fact, players coming and going as resources and will allow is a major part of what makes something an infinite game, so the number you play against today might be different than the number tomorrow. The rules are also in flux, as anyone—you included—has the ability to toss expectations out the window and flex to something new. Most importantly, an infinite game has no end set. There is no “winning” an infinite game, just the effort to keep playing as long as possible.
Running a business is an example of this. No one “wins” at business. You can have a good year and rake in some profits, but topping arbitrary metrics in no way makes you the best and forces other players to cede the field to you. The game continues as long as the company can operate, until eventually it can’t. But even at that point, the game goes on with whatever players remain until the cows come home.
Now let’s translate this to cybersecurity. Players shift, rules vary depending on the day, and just like in business, no one can win. You can go an entire year with zero breaches, but that gains you exactly nothing when it comes to the next attempt to crack your network. What does this mean for cybersecurity professionals? You have to view your efforts through an infinite lens if you have any hope of succeeding.
Another example. Say that you are considering educating your workforce on social engineering. A finite game solution might involve genning up a briefing, providing it to everyone in the organization, then chalking it up as a win with no need for future efforts. You’ve accomplished all the metrics, after all! Every player has been briefed, the rules are clear in that everyone had to attend and possibly pass a knowledge check to verify they paid attention, and you assess your victory if no one clicks on a suspicious link.
Cybersecurity (and organizational reality), however, do not fall in such clean lines. You have no guarantee that the organizational members you briefed today are the same as the ones who are a part of your team tomorrow, and you have zero control over what tactics and techniques adversaries may use trying to trick them. Rules mean less than nothing to a creative threat, and there’s every chance that threat can come from inside your organization. And finally, there can never be a victory in cybersecurity because there’s always another attack on the horizon.
Maintaining an infinite mindset is difficult. Our minds crave patterns, and a finite game provides those for us. By its nature, an infinite game forces us to look beyond the simple solution and accept that we do not have the level of control we’d hope for. But its in viewing that infinite horizon that a cybersecurity professional can protect his or her network for another day, which is as close to victory as we can hope to get.
Posted on July 4, 2022
The Art of Cybersecurity
Many moons ago, I had the onerous task of taking a Security+ certification test. I passed by the skin of my teeth and have dreaded the thought of taking it again. Luckily for me, there are ways to validate your continued work in the cybersecurity field to extend how long your certification lasts. Unluckily for you, one of those measures is via writing a blog post on some topic related to cybersecurity.
What will follow is the first of several Wanderings on all things cyber—with a twist. I will find and increasingly stretch bizarre metaphors to fit various cybersecurity and cyber warfare concepts in the hope that the Lords of Certification grace me with their Continuing Education Units so I don’t have to endure the gauntlet of that test again. So without further adueu, I present for your consideration cybersecurity as told by a man who proceeded it by roughly 2500 years—Sun Tzu.
I’d wager a decent percentage of the world has at least heard the term “the Art of War”, and a sizable chunk of that likely knows it references a book. These days, you’re more likely to hear it referenced in a board room by some suit instead of on a battlefield. And just like those overpaid consultants or motivational speakers, I will crib some of his ancient wisdom on strategy and force those round pegs into cyber-shaped holes. Let’s begin!
*Note: there are as many translations of Sun Tzu as there are ways to trick people into giving you their email passwords. The ones I’m using meet the general intent, but likely lack some of the finesse the author initially intended*
Quote #1: The general who wins the battle makes many calculations before the battle is fought. The general who loses makes but few.
When considering cybersecurity, one must always acknowledge that every day brings a shifting battlefield with no guarantee of safety. The Internet is a dangerous place, rife with hostile and malicious actors that earn their keep by ruining yours. Worse yet, there are legions of automated tools out there that constantly troll through systems connected to the Internet, just waiting for some known vulnerability to exploit. Why would you ever approach such a situation blind?
Preparation is key to success in cybersecurity. In this, the attacker almost always has the advantage. To exploit a system, all the attacker needs is one vulnerability to leverage, while the defender must consistently prove effective day after unending day. Not only that, but the attacker has decades worth of exploits and vulnerabilities to lean on, any one of which going unpatched leaves the virtual gates unlocked. Recognizing this means the defender knows they are in for a grind, and must come prepared accordingly. Researching various malware defense software (or companies, depending on the scale you operate at), purchasing trustworthy equipment secure from supply interdiction efforts, training yourself and employees on how to identify social engineering attempts—all of these are key to a defenders successful preparation.
Quote #2: The art of war teaches us to rely not on the likelihood of the enemy’s not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable.
The need for preparation from Quote #1 stems from the certainty that the adversary will come for your network. You may be a Fortune 500 company, a local business catering to potato sculpture enthusiasts, or just a blogger screaming into the void, but you are all equal in this: you are a target. If your cybersecurity stance consists of hoping that they’ll pass you over, I wish you luck when the next NotPetya rolls through your system like a rampaging horde of Huns.
Acknowledging that you are a target shifts the conversation from “will I be attacked” to “how will I mitigate an attack?” Notice I did not say prevent—nothing can do that, unfortunately. One of the sureties of modern cybersecurity is that with enough time and effort, any system can be breached. What you do to react to that, however, makes all the difference in the world. You’ll notice that companies like Google, Netflix, and Amazon rarely make the news for data breaches compared to some other companies. That’s because they know they’re huge targets, and they resource their cybersecurity sections accordingly. They still have network breaches, but they have prepared enough to account for them and react.
Quote #3: If ignorant both of your enemy and yourself, you are certain to be in.
Knowing you’re a target is one thing; knowing why is something else entirely. That knowledge helps you determine who might be after it, and knowing that helps you ascertain what sort of resources they can bring to bear against you. Your off-brand pun based food blog is not likely to draw the attention of Russian intelligence services quite like a company with Department of Defense contracts, so the level of resources to pour into cybersecurity will differ dramatically. Don’t sell yourself short though, I’m sure someone out there wants your secret family recipe.
The flip side of this is knowing yourself, and by that I mean your network. If you don’t have a functional understanding of what you’re operating on, you’re not in a good position to defend it. Imagine a king of olden times knowing an enemy is laying siege to his castle, but he hasn’t the foggiest idea where his city walls are or the men who are supposed to defend them. Failing to understand your network means you’ll never be able to apply your resources effectively, either to proactive defense or efficient response.
Sun Tzu may have lived thousands of years ago, but his wisdom has proven timeless in war and a myriad of other fields he never could have imagined. Cybersecurity is just one more area we can apply his lessons to, and a network warrior like yourself would do well to consider them. Wax on, wax off, my friends.
Posted on June 20, 2022
A New Journey
I write this with my newborn son sleeping just a few feet away, grunting in that way newborns do to charm their way into our hearts. I look at him and think of all the possibilities ahead of him. What will he do with his life? What ideals will he cherish? What songs will he sing? What will his journey look like?
The world today is in churn. While statistically speaking, it’s safer today than it has been in most of human history, it seems a precarious peace. Record breaking heat waves and supercharged natural disasters signal the onset of human induced climate change. War launched at the whims of a dictator rages in Ukraine. An attempted insurrection nearly succeeded in the halls of American government. Where will his place be in all of this?
I wish I could tell by looking at his peaceful form, hands twitching as his body learns how to control those crucial tools. Will those hands turn towards good or ill? Will he be the man others look to for aid and comfort, or the one they fear when they see his shadow darken their path? Will he grin as he wipes the sweat from his brow, knowing the value of effort put towards a good cause?
I have little say in what his journey looks like. Yes, what my wife and I do during his childhood will have a tremendous impact on his development, but we cannot–and should not–suborn his agency, his ability to choose for himself. We can merely point in a direction we think leads to happiness and wellbeing and hope it is such. It is up to him to make those choices, to choose the paths his journey will take. As the great Dr Seuss once wrote, “Oh the places you’ll go!”
He’s starting to fuss, our little one. Let’s see what it is he’s thinking.
Posted on June 5, 2022
Pitfalls of Pride: Failures in Leadership
The most recent mass shooting at an American elementary school is rivaled in its horror only by how the words “most recent” will likely be used again. I am not going to delve too deeply into this topic, especially since The Onion has gotten the point across better than I could since 2014. What I want to discuss is what I think is the root cause of this tragedy and others like it—pride. One Wandering is not enough to cover the myriad of ways pride can damage our lives and our society, so I will focus on one particular aspect of it today: pride leads to inevitable failures in leadership.
First, a primer. I believe that pride is at the root of many of the world’s issues, but how I view it may not mesh with your understanding of the word. Consider a spectrum with perfectly humble on the apex, and loathsomely prideful at its nadir. Every action we take falls somewhere along that spectrum, and the farther we fall towards the bottom, the more likely we are to inflict misery on others and ourselves.
An example: you are a parent whose child plays in a youth basketball league. Your child plays a fantastic game and the team sees him or her as the main reason for victory. The humble response would be to congratulate your child and their team on their excellent performance earned through their hard work, plus recognizing the value of their coach and the other parents who helped. The prideful response would be to beat your own chest on how it was all because of how you raised the child so they could do such a wonderful thing, and that the rest of the kids on the team are garbage compared to your prodigy. An extreme example, but one that shows how many options there could be between the two edges.
The important facet to recognize is that the lower one gets on that spectrum in one’s actions, the less likely one is willing to look beyond oneself for answers or input. This is the core of what I want to cover regarding pride and leadership. When a person or organization allows pride to take precedence over humility, they cause an inevitable decline in forward progress due to stagnation of thought and action.
Pride is inherently backward leaning instead of forward looking. A person or organization that tries to take pride in accomplishments not yet achieved is delusional, not prideful. Looking back on past deeds, however, provides a temptation that cloaks itself in self-satisfying logic. If what came before brought us to this point, then obviously more of that should accomplish more of this. A leader can take this assessment one step further: if I made that decision and got positive results on multiple occasions, then I am always right and don’t require further input. Input from external sources then becomes a threat to both the leader and what he or she has achieved, because it challenges both a perceived sense of superiority and threatens to supplant the status quo. Eventually, maintaining the status quo becomes more important than anything else and forward progress halts.
The primary reason why the status quo rarely results in a positive trend over time is that the world is not static. Technology, societal norms, the environment, and a host of other important features to human existence constantly change in subtle and complex ways. Think of how transportation has changed over the past century, from the Model T to the SpaceX Dragon capsule, or how in the past thirty years landlines have all but died in favor of ubiquitous IP enabled telecommunications via cellphones and Zoom calls. How many organizations collapsed because they could not adapt quickly enough to those changes? How many individuals lost their fortunes for the same reason? Fighting change has never worked out for the defender in the long term.
As the shock and dismay over the Uvalde school shooting fade, so too does the likelihood of action. I hope that our leaders recognize a status quo where active shooter drills are more common than fire drills with elementary school children is an abomination. I hope they are humble enough to overcome their pride and toadying to a minority of harsh voices with big checkbooks.
Mostly, I hope that I am wrong about what I think will happen—nothing.
