Cybernetic Security: Invariants, Identity, and Constraints
from Security Through the Looking Glass
If you are unable to get yourself food or water for a long enough period, you will die. We all know this. Our bodies tell us this with hunger and thirst. After a while we start to hurt, a headache or aching stomach. We will be compelled to do something about it, perhaps anything, to survive. You may even feel a bit of anxiety now even just thinking about it.
Some people override these signals consciously. They fast for religious reasons. They go on hunger strikes to resist oppression in the only way they can, or raise awareness about a problem that isn't getting attention. What self-control, one might say, imagining Kafka's Hunger Artist sitting stoically in his cage as he wastes away. (I mean, no one would say that, but I'm not going to miss such a good opportunity to throw in a Kafka reference.)
Control, including both the signals the body sends to the mind and the ability of the mind to override them and dictate the body, is precisely the subject of the study of cybernetics. But cybernetics, of course, isn't specific to biological system. It abstracts concepts into models that can be applied to plants, animals, machines, social systems, and many other things. One such model is the Viable System Model (VSM).
The VSM describes the abstract control components that a system needs in order to “remain viable.” The “viable” part of that is defined by a specific set of invariants. For biological things that means “have enough water,” “have the right nutrients,” “have enough food,” etc, while for businesses that generally means something like “have employees” and “remain solvent.”
All viable systems exist within environments and viability can only be described within the context of these environments. Their existence within an environment necessarily changes that environment, and changes to the environment may influence their viability.
The VSM, as a model, helps us think about the mechanisms which must exist, and the ways in which they must exist, within a system in order to maintain viability. Positively it tells us how to make a system viable or check that a system is viable. But that necessarily means it also happens to be useful for modeling.
So let's take these concepts and begin to think about how we can leverage the power of cybernetics to design or improve a cybersecurity program.
We need to start at the heart of the matter: viability. Whatever you're trying to protect either is a system that must remain viable, or exists within a system that must remain viable. Things that threaten that viability are called “threats,” where a “security threat” is a subset of those threats such that the threat may be intentionally realized by an actor. Now, by “remain viable,” we mean “must maintain a set of invariants.”
A company, as we have discussed, needs (at least) employees to work and money to pay them (if no others). These are the minimal viability invariants of a company. A department within a company may have constraints, perhaps based on metric targets or goals: must maintain 10% customer growth, must achieve positive cash flow for product sales by the end of the year, etc. Subsystems, teams, subteams, individuals, software, will all derive their own constraints (explicitly or implicitly) from these root invariants.
A system's invariants are enforced by the parent system (directly or through inheritance, say, from the laws of physics). Constraints are derived by the system or parent system in order to protect the system against violating the invariant within a specific environmental configuration. As the environment changes, constraints will also need to change; invariants must remain true as a property of the system across all possible environments.
So then, what are those invariants for the highest level system for which you are responsible? List them.
A system does specific things, generally in a specific way, in order to avoid violating these invariants. This defines the system identity. A store sells things within a specific market niche. A manufacturer makes stuff, from specific materials, with specific tools, for a specific market niche. I am a security engineer. I am writing about security. I may be able to pivot between security engineering work and technical writing, but if I try to be a baker tomorrow, and a landscaper next Tuesday, and a carpenter the following Friday, I will quite likely threaten my income. Without income, I will struggle to maintain the housing and food I need to maintain the constraints of temperature and caloric intake that keep me viable. As difficult as it would be for me, as an individual, to rapidly pivot, all the more-so for the shoe store to become a butcher or the cabinet factory to pivot to pharmaceuticals.
Identity informs constraints. What then is the identity of the system for which you are responsible? Are you responsible for a subsystem, such as a department or team, where your identity is derived from a parent system? If yes, how so? Write these things down.
What are the constraints that keep you from violating these invariants? List them.
These constraints may be things like “service and labor spend must be lower than customer provided income,” “services must comply with all applicable regulations to avoid fines,” or “the business must operate in a way consistent with the ethical framework of the community in order to retain employees and reduce retaliatory risk.”
Constraints will be derived from invariants, through various levels of system identity. If you are mapping constraints for a subsystem, you should be able to contextualize these constraints at least within the context of the next level of parent system above yours. A team should understand the department it's working it, a shop should understand regional goals.
You have been asked to record other peaces of information, such as invariants, identity, and derived constraints. This specific information will be useful in the future. But while invariants won't change, and Identity should rarely or never change, constraints are a product of invariants interfacing with a dynamic environment through identity.
This introduces us to the highest level cybernetic metasystemic function, and the dynamic environment within which a viable system must exist. This will set us up to talk in the next essay about the remaining metasystemic functions that allow our system to adapt to this dynamic environment, internally regulate, and manage complexity. In the third essay, we will revisit what you have written down here and use it to think differently about threat modeling.
For many organizations today, threat modeling lies somewhere between theater and magical thinking. Design remains uninformed by threat models, and threat models become dead documents that are written once and thrown away. Assets that should be related to threat models, such as incident response plans, remain disconnected. What should be a tightly-knit living web of knowledge about the risk lifecycle of software becomes an archipelago of dead and disconnected data.
This dead chaos breeds complexity, complexity that can be absorbed by a living knowledge system and a process that builds and leverages that knowledge. By putting the “cyber” back in cybersecurity, we will be able to build a security program that is actually able to consume the complexity we are experiencing today, and not choke. Keep your notes from this section. You will need them for the section on threat modeling.
⠀⠀
বহুকাল আমি নিজেকে একজন ভুল মানুষ ভেবে এসেছি। আমার পৃথিবীটা ছিল কুয়াশায় ঢাকা, যেখানে স্পষ্ট বলতে কিছুই ছিল না। আমার ভেতরে নিজেকে প্রকাশ করার এক তীব্র আকাঙ্ক্ষা ছিল, কিন্তু যতবারই আমি মুখ খুলতে চেয়েছি, ততবারই মনে হয়েছে যেন কেউ একজন আমার কথাগুলো বন্দি করতে ছুটে আসছে। ভয় ছিল আমার ছায়াসঙ্গী। তাই আলো থেকে পালিয়ে বারবার আমি ফিরে এসেছি আমার পরিচিত অন্ধকারে, আর সেই অন্ধকারই হয়ে উঠেছিল আমার একমাত্র পরিচয়। আমি মেনেই নিয়েছিলাম- আমি আদি থেকে অন্ত পর্যন্ত ভুলে ভরা এক মানুষ, যার জন্মই হয়েছে ভুল করার জন্য।
