You can’t go to a security conference nowadays and not hear at least 700 references to Sun Tzu and his writing, The Art of War. And how important and relevant that book is to the world of Information Security.
But let’s not limit our focus to the InfoSec guys. Life coaches (whatever they are) are abusing the subject with exaggerated comparisons and vague slogans. And the business people, oh, believe me, these are the most creative. Telling you how big of a war is out there and how to deal with it like a boss. I kind of secretly desire for a cooking show to refer to The Art of War and debate how to diminish cucumbers’ morale before chopping and throwing them into the salad. All for a better taste of course, because, you know, cucumbers are the enemies.
I don’t find it particularly amusing to be the one breaking the spell but somebody has to do it.
So, The Art of War is a military treaty from 2500 years ago. One other important aspect you have to consider is that the writing and translation process was complicated to say the least. The origins of the text and author are known only to a certain degree of confidence and the writing went through several translation and reinterpretation cycles. It does outline some generic principles which can be applied in various aspects of life, especially if one has the tendency to generalize. Otherwise it talks about:
- Using gongs, drums, banners and flags to raise morale (funny enough, some InfoSec companies take this ad-literam)
- Analyzing weather and terrain conditions. Showing your troops that you packed enough food for the winter. If your rival’s forces are crossing a body of water, don’t meet them in the middle, where you’ll both be bogged down. Instead, wait until half of them have landed and attack while the entire army is divided.
- How spies must be liberally rewarded and their work highly appreciated.
Again, if one is prone to the confirmation bias and willing to look for far-fetched parallels, he can identify in the above 3 bullets awareness, reconnaissance and intelligence.
For this kind of people I’m willing to make a few recommendations of good readings:
- Little Red Ridding Hood outlining the necessity for risk analysis. Red should of known better when walking the woods alone.
- Snow White, which teaches us the need for security assessments. Our heroine could have used one of the dwarfs for QA testing the apple.
- And finally, my favorite, The Three Little Pigs from which we can learn about the security in depth principle and the need for security architecture.
Next time you go into a meeting and talk about the importance of Information Security, use The Three Little Pigs as your support material (on your own risk).
The Art of War is a good book if read properly and understood in the context in which it was written. China, 2500 years ago. And it’s not the only strategy manual from that region and period, another good read is The Seven Military Classics of Ancient China. The only universal principle coming out of these texts is that you must know yourself, your opponents and the context, and adapt your strategies accordingly.
