In roughly the 5th century BC, the Chinese strategist Sun Tzu wrote a treatise that has long been one of the most famous military classics in the entire world. Its themes have profoundly affected not only Asian warfare but also have expanded to influence legal strategies, business principles, and, most recently, even cybersecurity.
Specifically, Sun Tzu had a lot to say about the most effective ways to prepare for conflict and address it when it happens. They cite the importance of utilizing mental weapons of strategy and forethought before ever resorting to the physical battle.
There is no doubt that Sun Tzu’s ideas are highly relevant in the arena of digital security. Perhaps the most glaring and easily exploited weakness of an organization stems from its established policies and practices. Unless a business is just starting from the ground up, its chief information security officer will have inherited a long-standing set of cybersecurity systems and protocols. Making extensive changes would not only be expensive but would also force staff to move out of their comfort zones. The result tends to be systems built on unstable foundations that are not equipped to change and pivot with today’s rapidly evolving threat landscape and prevention, detection, and remediation technologies.
How do Sun Tzu’s principles relate to effective cybersecurity? When followed to their logical conclusions with robust digital protection strategies, the following three tenets can be highly effective.
- “Know Thyself, know thy enemy.” In a nutshell, this refers to undergoing a comprehensive threat mapping and risk assessment process. Conducting a complete audit of all company functions enables the security team to identify critical data, reveal gaps and leaks in the digital infrastructure, and measure and prioritize risks. Only then can the team predict and categorize the adversaries that pose the most significant security threats.
- “Tactics without strategy is the noise before defeat.” This phrase refers to the strength of an organization’s incident response protocols, which should be determined long before a breach occurs. Superior strategies involve multi-prong approaches that combine technology with human expertise and strict adherence to monitoring and logging procedures.
- “Subdue the enemy without fighting.” Protecting critical assets is best accomplished by preventing attacks with robust security measures. It happens when the team thoroughly understands activity baselines to identify and act upon anomalies quickly.
As Sun Tzu would no doubt agree, war is not a single incident – it is usually a series of battles that include setbacks, stalemates, and victories. When it comes to safeguarding digital assets, organizations will do well to keep this and Sun Tzu’s principles in mind as they construct and maintain solid digital security measures that readily evolve with changing technologies and threats.
