Paths to creativity in security careers

One of the biggest security challenges faced by organizations and institutions today involves technical, social, structural and educational elements. This challenge is fostering the necessary creativity needed to maintain a business edge, to anticipate and respond to environmental change, to protect against unintended consequences, and to grow. Stakes are high, because a major pattern in security breaches is a creative outsider (or insider!) bypassing the stolid corporate machine. This session will present several approaches to fostering creativity in organizations, with an emphasis on the individual. Such individuals, it is hoped, will be better able to anticipate and cope with diverse security challenges. Three approaches will be presented. First is the hacker spirit. This is "hacker" in terms of creativity, curiosity and skill with systems, not an intruder or criminal. Hackers from Thomas Edison to Steve Wozniak, among many others, invented the foundation for today's technological society. Hackers are often characterized by a healthy distrust for authority, combined with the desire to verify facts for oneself, through formal or informal methods. Hackers are likely originators of new methods for bypassing security systems (though less likely as perpetrators), but more importantly can serve on the inside. Second is detailed understanding of today's complex systems. Cyberinfrastructure is complex, environmental systems are complex, social systems are complex - it takes a broad education and experience to be able to design, understand and repair them. Security challenges tend to come at the boundaries of systems, and conscious efforts are required to foster an interdisciplinary approach. Autodidactism will not produce enough people with the requisite skills, nor will they emerge from silos of disciplinary learning. Instead, broad multidisciplinary training is needed. Third is encouraging creativity in the organization, whether it is a school or university, a business, a government agency, or social organization. For a variety of reasons, recent trends are towards decreased individualism and limitations on freedom of self-expression. This is dangerous to a security posture, because it is likely that potential intruders will be thinking creatively. Courageous, creative, educated, empowered and experienced individuals are a key component to building adaptable and healthy organizations. The message for the people and organizations involved with privacy, security and trust is stark: the types of individuals described here will otherwise be adversaries.