In my quest to understand the elusive American puritanist psyche I've been reading up on origins and history of Christianity recently.
As a side note - original biblical languages are so much fun. Not only nobody is quite sure which tense in Biblical Hebrew is past and which - future, but even when the meaning is obvious, translations do so much moralising and sweeping all the blood sex and genocide in the Old Testament under the carpet.
Example: did you notice how many times a woman fiddles (uncovers, kisses, touches etc) man's feet in the OT? But never the other way around or, God forbid, a man to a man? It turns out, "feet" is an euphemism :)
Anyhow, this post is about striking parallels between some old religious metaphors and the modern "cybersecurity" ones.
Infosec thinking as Judaism of 1st century BCE
A quote from a very respected Biblical scholar:"Apocalyptic eschatology" is ... centering in the belief that
(1) the present world order, regarded as both evil and oppressive, is under the temporary control of Satan and his human accomplices, and
(2) that this present evil world order will shortly be destroyed by God and replaced by a new and perfect order corresponding to Eden before the fall.
During the present evil age, the people of God are an oppressed minority who fervently expect God, or his specially chosen agent the Messiah, to rescue them. The transition between the old and the new ages will be introduced with a final series of battles fought by the people of God against the human allies of Satan. The outcome is never in question, however, for the enemies of God are predestined for defeat and destruction. The inauguration of the new age will begin with the arrival of God or his accredited agent to judge the wicked and reward the righteous, and will be concluded by the re-creation or transformation of the earth and the heavens. This theological narrative characterized segments of early Judaism from ea. 200 BCE to ea. 200 CE"Let's change some words:
- 'World order' => information systems
- 'Satan and his human accomplices' => evil hackers, APT!!1!
- 'God' => well, I guess, it stays?
- 'The people of God' => various infosec consultants, from Mandiant to the forthcoming 13 tribes of the US cyberdefense.
You get my drift. There is also an awesome document called The War Scroll, describing the final fight of Sons of Light and Sons of Darkness... then there are Gnostics... There is a PhD in this somewhere.
Infosec industry as pre-reformation Catholic church
No needs for extensive quotes here, Catholicism is a popular topic this week. Just one example: exorcisms.A typical exorcism: a person was apparently possessed by an invisible evil spirit who caused all kind of trouble (Exorcist is a fine movie, watch it), then a licensed exorcist priest was called, who did strange things and expelled the immaterial possessor out of the victim's body, collected fee and told the victim to install a fountain with holy water, pray and not sin any more.
People sinned, confessed, sinned again...
The priests themselves were idealistic young men or hypocritical old farts who did not practice what they preached.
Substitution table:
- 'Satan', as before => 'bad hackers'
- 'possessed human' => 'infiltrated company'
- 'exorcists' => security consultants, especially DFIR type
- 'sins' => "bad" security practices
- 'confession' => audit or pentest, perhaps.
I could go on but it's time to wrap up, since we ought to celebrate: according to Iranian sources, Habemus Papam has been elected the new pope
