Read More Borges
It's our opinion—and probably our opinion only—that a red teamer will learn more about red teaming by reading the short stories of Jorge Luis Borges than by reading any number of books on technical topics. “But how can it be,” the hardened technophile will ask, “that I have anything to learn from Borges, who lived and died in an era before online shopping, big data, and dank memes?” Of course, this question merely confirms the asker's status as a hardened technophile and underscores his/her urgent need to read Borges. (If all our adversaries were hardened technophiles, we would relax our assertion; unfortunately, they are not, and many, we suspect, have been reading Borges conscientiously.)
We’ve discussed the “Library of Babel” (1941) before. Here, we will offer a few thoughts on “Funes, His Memory” (1942, and sometimes translated as "Funes the Memorius"). In this brief story, we learn of Ireneo Funes, a peculiar young man who "was known for certain eccentricities, among them shying away from people and always knowing what time it was, like a clock." ((All quotes from the story are from Jose Luis Borges, "Funes, His Memory," Collected Fictions, pp. 130–137.)) Ireneo is bucked from a horse, and though crippled by the event, gains the ability to perceive and absorb the minutest of details and remember everything. With this gift, he observes the passing of life in a way that makes his previous life seem like a muffled dream.
You might say that Funes becomes the personification of supreme left-brain powers, at least of those functions that we've traditionally assigned to that hemisphere. Funes is the master of every detail. As Borges relates through his narrator,
A circle drawn on a blackboard, a right triangle, a rhombus—all these are forms we can fully intuit; Ireneo could do the same with the stormy mane of a young colt, a small herd of cattle on a mountainside, a flickering fire and its uncountable ashes, and the many faces of a dead man at a wake. I have no idea how many stars he saw in the sky.
Yet for all his apparent genius, Funes was at times obsessed with two "foolish, even preposterous" projects: "an infinite vocabulary for the natural series of numbers, and a pointless mental catalog of all the images of his memory." We learn further that "Funes . . . was virtually incapable of general, platonic ideas." Indeed,
Not only was it difficult for him to see that the generic symbol "dog" took in all the dissimilar individuals of all shapes and sizes, it irritated him that the "dog" of three-fourteen in the afternoon, seen in profile, should be indicated by the same noun as the dog of three-fifteen, seen frontally.
Thus, though "He had effortlessly learned English, French, Portuguese, Latin," the narrator "[suspects], nevertheless, that [Funes] was not good at thinking. To think is to ignore (or forget) differences, to generalize, to abstract. In the teeming world of Ireneo Funes, there was nothing but particulars."
The technical particulars of security seem to fascinate us just as the infinite tick-tocking of reality consumed the fictional Funes. Is this fixation with detail the summum bonum of security thinking? It is, and, paradoxically, it is not. The digital systems on which we depend demand a Funes-like allegiance to detail. We do our best to comply, although our adversaries consistently expose the limits of our abilities. If only we could hire Ireneo Funes as our CISO—which, of course, would be a disaster. As much as detail counts, we also depend on the ability "to generalize, to abstract," even if we don't fully appreciate this ability during the eight days a week we tend to compulsory minutiae.
Developing the ability to generalize is part of the "something else" we must pursue if we are to master modern security. It involves pattern and systems thinking; it involves the ability to negotiate shifting and alternative narratives; it involves empathy, divergent thinking, and a willingness to embrace ambiguity—all the obverse of Funes' amazing, accidental skills. It also involves a willingness to spend some time reading more Borges.