Insecurity is a fascinating word for a profound concept. It is a word that I have rarely used
or thought about until recently and that makes me wonder as to the why
of it. Many seem to instinctively rely on the concept of “insecurity”
as an essential pillar of their self view or their world view. I don’t
disagree, its just that I think I have spent much of my mental energy
on its opposite, the concept of security.
Now I will try to turn directly to the concept of insecurity but I
think in order to gain any traction in my understanding I will have to
start with the opposite concept and work my way back from there. This I
think is a reasonable approach when trying to get a grip on any concept
that begins with an “in”, since it means the term is essentially bound
to its opposing entity.
The way I have come to understand security is like Linus Torvalds said
in a talk I watched online recently, “security work is all about
networks of trust” (yes, many others have said similar things…). When you understand security in that fashion lots
of things fall into place that don’t otherwise make sense if you think
of security as walls or locks and keys or any other such mechanism. It
also makes concepts outside of typical physical security more coherent.
“monetary security”, “mental security”, “emotional security”, “job
security”, they all can be understood under the same framework. They
are all about who you trust and who they trust and so on and of course
all along the line asking the questions of why do you trust, or why
should you trust and so on.
Businesses build up their security network by hiring people. They have
no choice in this matter. The core of any businesses security is who
works for them. No matter of fancy software or clever locks and gates
will make a damn bit of difference if there is an inside man in your
business. What’s more you have to hire somebody so you have to pick out
of a usually rather large pool of applicants people to work at the
industry. You have to try to find somebody in that group that you can
can trust. Not only do they have to trust the people that they hire,
but implicitly they are also trusting the people who the people that
they hire trust as well and so on down the line. Trust is essential in
the hiring process since a breach of trust could run deeper than just
having an unreliable untrustworthy employee who doesn’t get his or her
work done, it could open up a business to severe liabilities.
This is why businesses take so much stock in the recommendations of
their employees even though objectively we might argue that this is
unfair to perfectly capable applicants who are applying without that
inside support. A business that hires someone recommended by an
employee is explicitly extending that network of trust. They are
banking on the trust they already have for that employee being directly
applicable to the person that employee knows on the grounds, sometimes
shaky grounds, that the person wouldn’t have recommended another for
the job if the person didn’t in some significant way trust that person.
Another strategy businesses use to try and secure themselves is to do
background checks. Now interestingly enough these background checks are
themselves all about digging into someone’s trust network in order to
validate the degree to which the person can be trusted. The
investigators go around talking to family members and friends of the
person, direct or indirect acquaintances to try and find out what the
people who the person trusts thinks about the person and to try and
make sure the network is a real existing thing. Sometimes to dig deeper
an investigator may go to the people who the person trusts trusts and
so on down the line validating the testimony and sincerity of each
interviewee against the others looking for inconsistencies that might
set off alarm bells making someone not trust another person.
Now that we understand that basic idea of security, let’s turn now to
the idea of insecurity in the same context. Insecurity then obviously
would be a lack of security. Explicitly that means a break in that
network of trust, a node that cannot be trusted or a communication line
between nodes that leaks to others outside of the network who are not
trusted entities. Communication lines are easy, you just try and secure
the lines as much as possible. No matter how trustworthy your people
are, it is pointless if anyone can sit outside a business with a laptop
and ease drop on all of their data. It is also along the same lines
important for a business to not just worry about internal communication
but work as hard as possible to empower their employees to have secure
lines of communication with the people that they trust. Obviously you
ask them not to blabber about company secrets to others, but
realistically you have to acknowledge that some employees probably will
blabber. It is inevitable. If you are really concerned about minimizing
the risk of insecurity and not just about having someone to blame when
a security breach occurs, you will work to ensure your employees
outside of work communications are secure as well. That could mean
anything as simple as buying them a secure home computer system or as
complex as paying for their home in an area that the business feels is
secure against outside influence.
Insecurity in the nodes themselves is a not harder. How do you really
know ultimately if a person is trustworthy? Or more to the point in the
real world, how much trust should you put in each node and when?
Employers often have to decide between various amounts of information
to provide to each employee. How open should they be? How closed
should they keep the circle? One of the things that makes it complex
is the nature of humanity. People respond by being more trustworthy
when they are trusted. They become less trustworthy when they feel
information is being withheld from them or that they are interact in a
less than open environment. So businesses must balance the need to
treat each employee on a somewhat equal level with the simple fact that
in any network not all nodes are equally trusted.
Now anyway, insecurity in other matters beside the physical is
similarly about dealing with breaches of trust. Actually, when the term
insecurity is applied to other matters it is usually not about actual
known insecurities. Rather we are most concerned about “feelings of
insecurity”. That is, that sense one might have that one or more of
nodes or connections in their network of trust is not secure or more
often lacking evidence to determine whether or not it is secure, the
feeling that maybe perhaps they put too much trust in one or more nodes
too quickly or with too little justification.
Insecurity can arise from a lot of things. Sometimes its just
suspicions and intuitions. There can be a feeling that things aren’t
quite right based on subtleties that an outside observer would not
recognize and sometimes which a person themselves could not describe to
others. Other times insecurity can arise from hard evidence that is
impossible to ignore though sadly far too easy to misinterpret. Still
other times insecurity can be heightened by stresses on the system.
Since all security networks are based on rational decisions that we
make and reaffirm day by day, any time when we start to doubt our
decision making processes or when our mind is not processing at 100% we
will likely start to doubt our trust network as well. Certainly
“impending” major events fall into that category of adding stresses to
a system. All the more so if the events require choice that is not
wholly governed by rational thought to begin with and thus subject
inherently to distrust.
There are other ways insecurity can come about as well. One of the
biggest is through misinformation. You can get that misinformation from
all sorts of places, but most often it comes from communication with
untrustworthy entities, or entities that can be trusted but not about
matters for which they are being consulted. To throw out a trivial
example, a web forum is really no place to go for trustworthy advice
about anything for the most part and yet people rely on getting advice
from random people on the web all the time. Most of often they get
information that flatters them or fulfills their expectations and they
trust it on those grounds rather than its necessary basis on reality.
That can have a huge distorting effect on one’s trust outlook. But
much more often I think people become insecure by reasonably consulting
with people that they do trust and have good reason to trust, but about
matters for which the people they trust don’t have enough information
to form valid judgments. Those people aren’t being deliberately
deceptive, but they may well provide information or advice that is bad
through their ignorance. There is a subconscious component of this
too. We are likely to provide our trusted entities with just enough
information to form the opinions that we want them to form and thus
much like the random jaunt to the web forums for advice, you take back
the information that flatters you and affirms your pre-existing
judgments or at least makes making those judgments easier. Consultation
is never guaranteed to be effective but it is far more likely to be if
being based upon a shared information base that is similar in scope.
Also, disinterested advice is likely to be more helpful than those who
have self interests bound up with the matter of discussion.
Perhaps the most obvious cause of insecurity in the inward cause.
People feel insecure about something when they doubt themselves. In
other words all trust networks have a subjective central node, a “you”
as it were. That node forges connections with other trusted entities.
If that node comes to distrust itself, then it will distrust the
connections it creates. It is like having your home computer with a
virus on it. You can’t really do anything with that computer until you
get rid of the virus, because every connection it makes, every image it
shows you, every avenue of communication you have with the computer is
untrustworthy. The computer has been compromised. You have to distrust
everything about it until the situation is rectified.
So with ourselves. If we feel we are “compromised”, that is inherently
incapable of making trustworthy judgments, we will be distrustful of
others and feel insecure. Even if this arises later on, a person is
likely to start to doubt earlier trustworthy judgments not made while
“compromised”. One wonders about his or her inherent nature much like
you might wonder if your infected computer was ever really “secure” to
begin with. Maybe hackers were there messing with my stuff all along!
And it could be true of course, but that kind of self-distrust is
radically disruptive and dangerous.
Tightly bound with this idea of self-doubt induced insecurity is the
idea of external-doubt induced insecurity. Recall what I said earlier,
people are likely to become more trustworthy when they feel trusted.
Sadly, the opposite is not an equal but a greater force. When you feel
that the entities you trust don’t trust you in return it will make you
question why that would be or how that could be and thus start to doubt
yourself and hence as a consequence you start to doubt your trust
network decisions and feel insecure.
So those are some of the ways in which insecurity can arise I believe.
And of course in the real world, it’s never just one of those things…
And when there is more than one, there is the possible and likelihood
of good old feedback loops that grow insecurities further and broader
than they were before. The simplest example, person A doesn’t trust
person B so person B doesn’t trust person A causing person A to trust
person B even less and so on. Worse, when person A starts to feel
insecure, person A might make insecure judgments about whom to trust
and then those untrustworthy entities could provide information that
increases person A’s insecurity. Person B might start to feel insecure
and that insecurity inhibits their ability to handle their work load
making person B feel even less secure. And so on and so forth.
One of the biggest signs of a trust network starting to break down is
when entities start actively looking for hard evidence upon which to
base their pre-existing insecurities. Why? Because if and when data is
found, (and there’s almost always something to be found) it accelerates
the feedback mechanism. ie it will seem like the ultimate breach of
trust on all sides eroding whatever foundations remain within the trust
network. Businesses go through a very hard time when there are scandals
involving management investigating their employees directly. This
usually leads to pretty massive exoduses of employees who choose to go
elsewhere where they feel they will be more trusted. Only those
businesses that have a strong foundation of trust built upon many years
tend to avoid such a calamity.
But there’s a much better example of trust-network collapse in the real
world than wire-tapping scandals. It’s what’s happening in the United
States as a whole after 9/11. Really I’ve never seen such a more
massive and swift trust breakdown amongst two larger groups. In the US
currently we live in an era of radical distrust for both our government
and our fellow citizens. The most “open” and “free” country in the
world is under the grips of what I can only call a kind pf mass
internal psychosis. There was a story on npr one day not long ago that
made me cry it was so indicative of this problem. It was describing a
kind of grotesque distortion of a political debate between two radical
members of the Left and the Right in a part of the world evenly
ideologically riven between the two groups. It was a kind of sick and
terrifying farce in that both sides virtually ignored each other,
catered to their respective crowds and there were no attempts
whatsoever of trying to gain any sense of shared understanding with the
other side. These people were neighbors living in the same country
under pretty much the same circumstances but as far as they were
concerned those neighbors had become “the enemy”. Trust was no longer
even an option. It is as if the trust network of the US is riven in
half along strict ideological lines.
One way you can sort of see how this is happening is looking at the way
in which communication is occurring in the US. Politics has become
almost entirely about finding ways to attack and discredit your
political opposites. To that ends we are constantly investigating one
another trying to find that smoking gun that we generalize and prove
that “those people” don’t have our best interests at heart and that
“those people” can’t be trusted and are dangerous to be around. And we
find it. Again and again we find reasons to hate one another
solidifying our distrust. And all the while that insecurity we feel
increases. Our uncertainty about the future increases and we live in
perpetual doubt. Mark my words, we are heading toward a very bad place
politically if this current trend continues. Fortunately I do see signs
of it abating a little so only time will tell.
This of course brings me to the heart of the idea of insecurity, the
true cause of causes, and it should be obvious what is by now since it
often serves the role as the true cause of causes of pretty much
everything I write about. Funny that. The human experience is driven by
such a few small but profound concepts that give rise to a plethora of
varied interesting ideas.
Anyway, what is that cause? You guessed it. Fear.
Post 9/11 ideological rifts increased in the US not decreased. Why is
that? Because we’re afraid. Why do we distrust each other and
ourselves? Why do we do stupid things? Why do we think harmful
thoughts? Why do we live false lives and make dangerous decisions? Why
do we look outside ourselves for validation and support? Why do we take
everything so seriously? Because we are afraid. I’ll just leave it at
that.
So alright then if we understand what insecurity is: a breach in a
network of trust. And we understand what causes it: fear. Can we say
something now about what stops it? What to do about it?
The answer actually derives pretty directly from the analysis we’ve
already gone through. To heal insecurity, you build a network of trust.
And by that I mean actually a network on a lower level than the
trust-network between people. I mean to build a network of trust
between events and choices. One trustworthy act that implies or creates
another. One word of honesty that leads to another. Connections between
ideas and words and thoughts and actions. Trust here to feel more
confident about trust there and less fear of distrust elsewhere.
It sounds so obvious that we must naturally think “oh that will never
work”. And it might not. Not all networks of trust can be reformed at
all. And some that are reformed are not reformed in the same way. The
new connections that take the place of the old severed ones might have
to go across different pathways. If there are any opportunities to
build those connections even at the smallest level than the possibility
of the elimination of insecurity exists no matter how destructive the
downward spiral of insecurity can seem. The answer to a downward spiral
is an upward spiral and such a spiral can only arise moment by moment
piece by piece. It’s never fast and can never be rushed. It’s a day by day kind of a thing.
Some might question whether every breach of trust should be healed, and
there may be some good arguments that not all should. But I tend to
disagree. Security seems to me to always be better than insecurity and
it’s always beneficial to have some level of trust of others if at all
possible than none.
Of course there is one other aspect of building security that I’d like
to touch on that people often forget to take into account. And that is
the sometimes inherent value of taking security risks.
Again turning to the business world as an example, some companies come
to realize that they have to take considerable risks with their
security to be able to establish deeper long term security. The
simplest example is hiring students fresh out of school. For those, a
business has no record of that students trustworthiness in a business
setting to go by. They don’t have particularly relevant testimony to
base their decision upon. What’s more the very young are more likely to
leave and look for another job taking their knowledge with them.
And yet if a company only hires people who have been in the industry
for a while that lack of risk taking can be extremely detrimental to a
companies long term chances of success. You need the influx of new and
fresh ideas that students bring and you need people who are young and
can learn quickly and be very adaptive.
Another good example is when a company chooses to hire someone who is
known for being willing to break into computer networks for their own
gain as an expert to advise on securing the business. This probably
isn’t a big risk but it certainly can be perceived at one. Indeed in
general it would seem risky to hire anyone who has already proven that
they are smarter than you and willing to do things to your detriment
for their advantage. And yet, betimes this is the best thing you can
do. That expertise you won’t get anywhere else and to get the best work
you need the most intelligent people you can get. But each person you
hire is a risk.
Amongst governments, security risks are essential too. Governments
often need to ally themselves with untrusted enemies in order to
achieve some ends. The enemy of my enemy is my friend and all that.
Now how come taking big security risks can work out? Surely if you are
starting off with a foundation of distrust that would lead to spiraling
insecurities like the kind I’ve described above wouldn’t it? The
answer is, not necessarily. When you take a security risk, it often
means putting unfounded and even unjustified trust in an entity. And if
there has been any theme at all to this giant essay of random musings,
it is that trust yields trust and vice versa. So if you take a risk in
adding a node in a trust network to an entity that you might have good
reasons not to trust that node may eventually become a node worthy of
your trust and perhaps even one day your most trusted node of all. Of
course you tread cautiously in such matters.
Actually, all initial connections are leaps of trust in this manner. We
rarely have any *good* reasons to trust anyone a priori. It’s just that at any
given moment in our lives we are so grounded in trust-networks that we
often find it difficult to distinguish to what extent we are making or
strengthening a connection on faith alone versus a connection on
reason.
But what I am trying to say here is that both kinds of connections can
turn out to be valuable. Sometimes taking the greatest risks can prove
to yield the greatest benefit. Sadly though, we never know.
(14 ratings)