When last we met, Carl took a dig at all the people who have quick comebacks, but crumple under real pressure. So what makes for a person that actually does well under the sort of pressure of a leader in combat? Please turn to page 302 of the Modern Library edition…
When things are going well, it’s easy to look good as a leader, because you’re clearly successful. There’s also not much pressure, so you’re probably performing at your best. However, regardless of how great a leader you have the potential to be, you’ll never look great when the sailing is smooth. It is only when things are going wrong, when the pressure is on, that you have an opportunity to pull victory from the jaws of defeat and show what you’re truly capable of. Naturally, that is easier said than done, for when “things no longer move on themselves like a well-oiled machine, but the machine itself begins to offer resistance” it gets hard to lead.
This isn’t necessarily your people willfully working against you (though that isn’t uncommon during tough times), but just how any imbalance can throw everything out of whack. A single disturbance in the supply line can have some really weird ripple effects. In a corporation, any disturbance to the company’s ability to accept or make payments, or a glitch in payroll, will make for lots of unhappy employees that may or may not be sympathetic to the work you’re trying to do to fix the situation. It takes some serious leadership skills to overcome your own organization fighting you.
To do this well, you need a certain amount of ambition. I’m not saying there’s not room for people who are just doing their jobs! But those maybe aren’t the people you want as a General or a CISO. I want people who want to change the world/company in those key positions. The trick is there’s a fine line between ambition and “hankering after glory” (naturally there’s a German word for that: Ruhmsucht). In combat, that can turn particularly dark.
No doubt it is especially in war that the abuse of these proud aspirations of the soul were bound to bring forth the most shocking outrages upon the human race, but by their origin these feelings are certainly to be counted among the noblest that belong to human nature, and in war they are the animating spirit which gives the gigantic body a soul.
I suspect this is what we see in many of the stereotypical Silicon Valley startups, where highly skilled, highly ambitious people are doing what they think is good, but are actually unleashing tools of targeted abuse for use against the most vulnerable populations. Or how often is the NSA described as soulless? Again, “the thirst for honor and renown still remains indispensable,” especially for senior leaders: “has there ever been a great commander destitute of ambition, or is such a phenomenon even so much as conceivable?” but that ambition must be tempered.
A couple of terms that need to be defined:
- firmness: dealing with the force of a single blow
- staunchness: dealing with the duration of pressure
- self-command: balancing “the excited emotions without destroying them”
The difference between firmness and staunchness is very important, even though we are not talking about physical force. I was able to take SANS SEC530 and a point that Eric Conrad made repeatedly was that the way to get things done was “steady pressure over time.” He was describing staunchness, not firmness. Whether a leader of a military unit or a business unit, you probably have a lot of institutional inertia that you’re battling, and you’re not going to be able to change the direction of that organization quickly. However, with staunchness and knowledge of where to apply that pressure, you can gradually change an organization.
While not directly related to staunchness and firmness, self-command is a very important concept, because it is what allows the logical part of the brain to take control of a situation. “It is only through this balance that the mastery of the intellect is secured.” A person with self-command doesn’t not feel emotions, but “a stout heart is one which does not lose its balance even under the most violent excitement.” In short, leaders should care, need to care, but can’t let their feelings run away with them – feel, but be cool about it.
Carl rambles for a bit about different temperaments. You can easily read into this about as far as you do any writings on personality types, whether MBTI or astrology. That is: you can try to bucketize people based on their strengths and flaws, but ultimately the flaws of each type can be overcome, and the strengths may never fully manifest, so people are people and everyone needs to work on something, so personality types are a horrible basis for selecting people for roles. Moving on.
In the heat of the moment, you’re going to be flooded – with new information, your previous decisions, other people’s opinions… it is a lot. You’ll likely be tempted “to hold fast to these results of previous reflection, in opposition to the stream of opinions and phenomena which the present brings with it.” This would be bad; you don’t want to be obstinate in the face of new information (more on that in a bit).
Part of the challenge is that “there is often wide space which cannot always be traversed on a visible chain of conclusions.” You know in your gut what the answer is, and you kinda know how you got there, but there’s still some really crazy leaps that you had to take and even with coup d’oeil you don’t know if that’s really good enough, especially when lives/your company is on the line. That is absolutely terrifying, so the safe path is to stick to the decisions you’ve made previously, right? Well, this is war. Nothing is safe.
A maxim that Carl recommends is “in all doubtful cases to adhere to our first opinion and not to give it up until a clear conviction forces us to do so.” What constitutes as clear conviction? Carl is silent on this subject. Thanks, Carl. I am a fan of the maxim that I’ve seen floating around the Twittersphere lately, which is “strong opinions, loosely held.” Particularly as a leader, you can’t afford to be wishy-washy – you must have strong opinions. But you can’t let yourself be limited by the past – be willing and able to change your opinions based on new facts. But those new opinions must have a basis.
When you are completely unwilling to change opinion, you are obstinate. Carl claims this is more a fault of temperament than a fault of intellect. It is “resistance to our better judgement.” If you know the situation has changed, then so to should what you are doing about it. Whenever tech changes, so too should your thoughts on security. Just look at how password guidance has changed, based on available tech and what the actual threats are against passwords.
If you are a commander or C-Suite, you have a heck of a job. (Also, this may be one of the better descriptions of the “cyber battlefield” that I have ever seen.)
The commander in war must commit the business on which he is engaged to a space which is his partner in it, which his eyes cannot survey, which the keenest zeal cannot always explore, and with which, owing to the constant changes taking place, he can seldom become properly acquainted.
These challenges apply not only to the commander/defender, but also to the adversary/attacker. “He who by talent and training masters it will have a great advantage on his side.” In theory, “as a rule of the two combatants (the defender) knows much more about the locality than the other” but we often claim that the advantage here belongs to the attacker. Why is that?
For any decent attacker, the first thing they do is gather intelligence about their target (in fact, this may be how they select their target). They know that they don’t yet know anything about their chosen battlefield, while the defender assumes they know everything except for the time of battle. It is this assumption that can trip up defenders, and this lack of assumption that pushes attackers to gain a full understanding of the field before they launch their first attack.
This very peculiar difficulty must be overcome by a mental gift of a peculiar kind called sense of locality, a term which is too narrow. It is the capacity for quickly forming for oneself a correct geometrical representation of any given piece of country and consequently of correctly and easily finding at any time one’s position in it. This is obviously an act of imagination.
This is a really interesting concept that I would love to see discussed some more. I’ve heard it posited that attackers think in diagrams, while defenders think in lists, and that is part of why advantage: attackers. I would posit that whoever has that sense of locality has the advantage, and people with that sense tend to think in diagrams. I would also state from experience that it isn’t a thing that is cultivated within system/network administrators, which is why there is the stereotype that it is lacking within all defenders? Anywho, I concur that imagination is required, regardless of diagrams/lists. There needs to be a sense of “what if…?” and “assuming <thing> will fail…” in order to do any sort of risk analysis.
Carl posits that “scope for the exercise of this talent naturally increases with height in rank.” While I will agree that scope increases, I’m not sure that the talent does, as well. In fact, he later relates that “there is nothing more common than to hear of men losing their energy in being raised to a higher position, to which their abilities are no longer equal.” It seems that promoting to one’s level of incompetence is not a new phenomenon.
Putting aside the reality of skills of who gets promoted, it is clear that there is a need for a broader view in those who get promoted, and that those personnel need to be able to grasp the gestalt of a situation very quickly. While Commanders/CISOs have staffs that feed them the information they require, and are able to advise, it is ultimately that person’s job to make decisions, so “a considerable talent for quickly and clearly grasping the features of a country lends to his action an easier and firmer step.” While commenting that it is terrifying that I find myself making the decisions that I do, I have remarked that much of my job is having both the breadth and depth of knowledge to be able to make decisions on new situations quickly and have them turn out to be good. I’m far from the level of a General, but that illustrates the point that these are important skills for all leaders, whether leaders of people or purely technical leaders.
There’s also a discussion to be had here about what is the correct depth for any particular level of leader. How far should the General be able to drill down into troop movements? How much should the CISO know about their network architecture?
Simultaneously, these leaders need to look up and out of their own organizations. Leaders require “a keen insight into state policy”, such that “the general becomes at the same time the statesman.” It is nearly impossible to divorce information security considerations from geopolitics. “On the one hand, he must comprehend in one glance all the political conditions; on the other, he knows exactly what he can do with the means at his disposal.”
What does the leader do with that knowledge about their own capabilities, and what is happening out in the world? They need to do some risk management, calculate probabilities, and figure out which events are worth throwing money and energy after. But this isn’t simple math. “Bonaparte was quite right when he said that many of the decisions a general has to make would furnish a problem of mathematical calculation not unworthy of the powers of a Newton or an Euler.” Have I mentioned yet that I am interested in what actuaries think of cyber risk?
Someone at the top of their game is able to set “aside a thousand half-obscure ideas which an ordinary intellect only brings to light with great effort and over which it would exhaust itself.” And they stick the landing – they actually select a good course of action, and are able to execute it. Naturally, to do that, they require not just skill and intellect, but “those qualities of temperament and character of which we have treated.”
The bottom line for this entire chapter is that “there is always a great difference between cognition and volition, between knowing what to do and being able to do it.” If the leader’s activity “did not manifest itself in the final success of his work, and were only accepted on faith, it would rarely become a matter of historical importance.” PCAP or it didn’t happen, as we say.
A point that Carl tacks on to the end that I find rather interesting (and something that I’ve seen brought up in the Infosec community) is how
Most of the deliberations and mental conflicts which precede the execution of great schemes are purposely concealed because they affect political interests, or the recollection of them is accidentally lost because they are looked upon as mere scaffolding which has to be removed on the completion of the building.
Very rarely do the failures make it into formal academic writing. Rarely do people talk about all the steps they didn’t have to take, the courses of action they rejected and why they were rejected. Let’s talk more about the journey, and not just the destination.