This isn’t actually a very long chapter (~15 pages) but I have lots of opinions on this topic, so this will be getting broken up.
Carl opens the chapter with this absolutely beautiful paragraph:
Every special activity, if it is to be pursued with a certain perfection, demands special qualifications of intellect and temperament. When these are of a high degree of distinction and manifest themselves by extraordinary achievements, the mind to which they belong is distinguished by the term “genius.”
He goes on to define genius as “a very superior mental capacity for activities.” Inherent in this is the matching up of the skill set with the activities. Having a genius for one thing, but pursuing another, will probably not turn out very well.
For this reason, there isn’t a singular talent for warfare. We must “generally bring into consideration all the combined tendencies of the mind and soul toward military activity, and these we may then regard as the essence of military genius.” Genius in one particular subset of warfare does not inherently give one a genius for warfare, generally.
Similarly, some of the coolest Infosec people to talk to are those that haven’t specialized too deeply. They have strengths, yes, but they understand how their piece fits into the whole. They have a “harmonious combination of powers in which one or the other may predominate, but none must be in opposition.” This can be someone who understands both red team and blue team, or who can dive deep into the technical weeds, then translate that into management speak and understand the business impacts of making changes. They lack tunnel vision.
But, this combination of breadth and depth isn’t for everyone. “Were every combatant required to be… endowed with military genius, our armies would probably be very weak… it can but rarely be found when the mental and moral powers of a people are employed and trained on so many sides.” The most obvious example of this is the myth of the full stack developer. It’s great to want a few people who are awesome at everything, but if you wait for that person to come along, you’ll miss out on the 10 specialists who can accomplish the same thing (and probably more) by working together, and you’ll never actually hire anyone. Don’t let perfect be the enemy of good.
“War is the province of danger, and therefore courage above all things is the first quality of a warrior.” We don’t generally think of courage when speaking of genius, but just go with Carl here. “Courage is of two kinds: first, courage in presence of danger to the person, and next, courage in the presence of responsibility… we speak here only of the first.” (don’t worry, Carl will get to the second kind of courage) In Infosec I’m not generally super worried about what people do in presence of physical danger, but there’s still some interesting points to be made here.
To that end, we’re going to further subdivide physical courage: “First, it may be indifference to danger…” On the surface, this seems less than awesome. There’s learning what legitimately isn’t dangerous, and then there’s being numb to actual dangers. Wearing my SOC analyst hat, I have needed to be aware of what could be ignored (background radiation of the Internet) versus what was being apathetic due to alert fatigue or frustration from management not understanding the impacts of some risks.
“Secondly, courage may proceed from positive motives, such as ambition, patriotism, enthusiasm of any kind.” This is dangerously close to glory seeking. In combat, there’s significant potential to get people killed with this behavior. For computer geeks, this may be what leads to the “Infosec Rock Star” and “stunt hacking” behaviors that can lead to the rest of us that are just trying to do our jobs not being taken as seriously.
“The two combined make up the most perfect form of courage.” Cool logic and fiery passion are complementary traits. I need people that understand the difference between “let’s step back and analyze the root cause nice and methodically” and “WE NEED A FIX NOW!!!!!1!!!!!!”, and who understand when each is the more approrpriate action to take. I suspect this is more of a spectrum than a binary set of behaviors.
Given Carl’s focus on in-person warfare, he naturally spends much of his time focusing on physical ability as well as the ability to set aside all the discomfort that you’re feeling. However, “if we go further in the demands that war makes upon its votaries, we find intellectual qualifications predominating.” Making room for us geeks to shine!
We again discuss uncertainty: “three-fourths of the things on which action in war is based lie hidden in the fog of a greater or less uncertainty.” This is absolutely true. Blue teamers often bemoan how the red team gets a better sense of the network map than they have themselves, while the red team may not have any sense of what the blue team is able to do in order to monitor their activity – only what blocks their activity. Similarly, even if the victim has perfect visibility into their own network, they can only see their own network. If they have some good information sharing agreements, they still only know what they know; they will never know absolutely everything that the attacker has done, or what all systems they have touched. Professionals on both sides need to extrapolate from what limited information they have.
“…the person acting in war constantly finds things different from his expectations. This inevitably has an influence upon his plan…” In common terms: no plan survives first contact. Yes, plans can and will go sideways. This doesn’t mean that we give up on planning; this means that we plan for failure. We develop COOP and rollback strategies (and hopefully rehearse them) so that we have some sense of what we can do when things are not going well.
Perhaps most importantly, the planning process gives you the information that you need to make decisions for when things go sideways. You should already know what resources are available to you, the costs of using each of them, and what hurdles are in your way. This quick assimilation of known facts and new circumstances is a skill unto itself, but it is an important one to have.
“Two qualities are indispensible… and intellect which… is not without some traces of inner light which lead to the truth (coup d’oeil) and next, courage to follow this faint light (resolution).” Coup d’oeil is literally “stroke of the eye”, but is often translated as “glance.” Thus: at a glance to determine where to focus the attack, or where to start your investigation, or otherwise quickly determine how best to accomplish your mission.
“It amounts simply to the rapid hitting upon a truth which to the eye of the ordinary mind is either not visible at all or only becomes so after long examination and reflection.” I’m going to gush here for a minute because this is a really cool thing to experience. Have you ever had the experience while troubleshooting a problem where you have absolutely no idea what’s going on, you feel like you’ve hit a brick wall, and then it feels almost like someone whispers the answer in your ear, and lo! That is actually what is going on! You’ve solved the problem!
Intellectually, you probably realized that there’s whole lot of skill and knowledge and experience (especially experience!) that led up to that moment. But in the moment there’s just the certainty that this is the correct answer, but you have have no idea how you arrived at that answer, and its cool but also a little scary. It’s really kindof trippy to go through that. But if you’re really good, those things keep happening, and you learn to trust that voice with more and more certainty. I feel like that is roughly coup d’oeil.
The trick with coup d’oeil is recognizing it from the outside. Some people are just really good at sounding confident when they make snap decisions, while others legitimately have that insight that is required to make a good fast decision at a glance. If you don’t already know that person’s history, it is hard to distinguish the two, because you don’t know which is which until you see results.
Moving on to resolution: “we do not mean courage in facing physical danger, but courage in facing responsibility.” (told ya this would be followed up on!) “It is not… an act of the intellect but one of feeling. Mere intellect is not quite courage for we often see the cleverest people devoid of resolution.” I don’t know if there was an equivalent in Carl’s time for “sick burn”, but this is definitely it. He could easily be dunking on half of Infosec right there.
Most of us have some decent (if not above average) intelligence if we’re working in this field. Cool. But how many of us have the will to use our skills and intelligence to change the world, when doing so will probably be uncomfortable? How many of us are willing to a good job of speaking truth to power (I don’t mean ranting, I mean presenting a well-formed argument to the right person at the right time)? How many of us will give up the cool, well-paying job to work with the government to actually change tech policy?
“Resolution springs only from na act of the intellect, which makes evident the need for daring and determines thereby the will.” Intellect and courage need to work together to form resolution. One has to both know what needs doing, and be willing and able to do it, before one can actually accomplish that goal. Intellect is necessary because it has to be the right thing, not just the easy thing. Or, as carl puts it, “men of little intelligence can never be resolute… they may act without hesitation, but they do so then without reflection…”
As mentioned earlier, this isn’t just about making decisions quickly. Even if they’re sometimes right “it is the average result which indicates the existence of military genius.” We have to see the end results of these decisions, and how they stack up over time.
On Infosec Rock Stars: “A telling repartee is more the work of a ready wit; a telling counterstroke in sudden danger implies above all else steadiness of emotional balance.” Odds are, Twitter isn’t your battlefield. You can talk a good game all day, but unless you’re actually doing good work, you’re not actually doing good work. Quick comebacks are cool, but aren’t remotely equivalent to making a decision that is both good and fast in the middle of an incident.
The point on emotional balance is a really good one (particularly when it comes to Rock Stars) – I need people whose egos aren’t tied up in their decisions. I need people that act for the good of the organization, whether or not they look brilliant doing it. Some of the most amazing people I’ve worked with are people you’re never going to hear of because they don’t have time for all this drama. Some of the most visible people in this field are also the biggest jerks. This isn’t to say there aren’t visible people doing awesome things, but some days it feels like they’re the exception – like it is hard to maintain emotional balance when in the public eye.
I’m going to leave you here for right now, and pick back up on what it means to be a genius at a later time.