How biology defines security

Exploring how our biology, from hormonal responses to social behaviours, shapes our feelings of security.

Introduction

What happens when we strip back the concept of security? We first confront our philosophies and our psychology, but do we make the leap to examine our biology? In some way we already do this in social engineering when talking about things like amygdala hijacking, but do we go far enough?

Security is a feeling about a perceived state of protection. A feeling is an emotional response which is subjective. This means that at the most basic level any requirement for security to reflect reality doesn’t exist; it is all in our minds. Our experience is shaped by our innate biological attributes. Considerations of the emotional or intellectual requires a biological system in which to operate, obviously. Within this system we understand that hormones create the feelings in response to stimulus which underpins feelings of security. How we feel about something like security is a chemical response. It is a by-product of the hormones that course through us as we respond to stimulus. Gaining some understanding of the human condition from a biological and sociological perspective gives some level of insight as to why psychological methods are effective in influencing behaviour.

Our biology introduces conditions and constraints as we are trapped within our own physicality. Our perception is dependent and experienced within our corporeal form. We can’t directly experience beyond the senses that are integrated into that form, yet we understand that there is more to existence than what we can perceive. What we receive from our senses creates a model, an imperfect description of the world as we see, hear, smell, feel, and (if we are feeling brave) taste it.

But what does all this tell us about security? Is there a biological imperative to feel secure?

What are we?

It might be useful to consider what traits can be ascribed to humans and think about what is at our core. Of course there are attributes that are physical. Biological sex is a factor as we need to procreate in order to continue the species. Living until the point of being able to raise children and ensure there is a next generation means that survival is a requirement. To ensure our survival we need protection against the things that threaten that. Protection is the means to prevent harm.

We will skirt over aspects like our bipedal nature and opposable digits that gives us the capability to make tools, computers, or weapons. These physical traits govern how we operate within physical spaces and how we can inflict harm on each other. This is an interesting subject however that’s not what we are here for.

There are some attributes that can frame some interesting exploration. It is not controversial to say that the following are traits that exist within the human condition.

• Emotionally driven

• Individual agency

• Pack animals

• Adversarial and conflict driven

• Hierarchical

It is these attributes that lead into the emergence of psychological and philosophical mechanisms. I’ll take any opportunity to berate folks with a fucking triad. So, I offer my own deliberately asymmetric ‘triad’ which I proclaim to represent the constituent parts of security as an abstract concept. Let’s call it the BimPPi trinity.

Emotionally Driven

We like to think we are rational agents and that our decision making is predicated atop of a logical set of processes. For the most part, this is not true. Our thinking is coloured by our emotional state which is caused by hormones and biological mechanisms. Dual Process Theory indicates that the majority of our decision making depends on automatic processes. This is said to be up to 90% of all decision making. Dual Process Theory is commonly referred to as System 1 and System 2 thinking. System 1 is automatic and subconscious whereas system 2 is a deliberate and conscious mode of thought.

Emotional state is a key factor in Dual Process Theory and the production of hormones that influence mood becomes a key consideration. How many phishing scams or otherwise has there been that introduce a stressor such as a time constraint to make people act impulsively to alleviate their discomfort and push people towards the emotional thinking of System 1? Cortisol and adrenaline are stressor responses and create the fight of flight reaction, again heavily in System 1. The practical application of social engineering hinges heavily on the hormonal release mechanisms to elicit the desired response. Techniques like instant rapport within social engineering depend on the production of oxytocin. They are calibrated to promote the release of hormones to achieve a desired outcome.

Contributors to System 1 thinking can be shown in the following way.

We can consider feelings of security to be mainly rooted in System 1 thinking. This is especially true in the IT realm where the measures and data that are presented are rarely a description of the real world so rational consideration cannot occur. We tend to present so called measurements of security as analytical but really what we are dealing with is a form of manipulation that has a dependence on biases and heuristics that are found within System 1. I use the term bias to describe well established cognitive biases, not the colloquial form used by screeching idiots in HR departments.

While it is possible to adopt a more rational, System 2 approach, it requires significant effort, consideration, and practice. Protective states can be critically assessed and described, but the lack of fidelity within the existing 'risk management' hegemon means that decision-making will continue to depend on emotional states and the biological systems that produce hormonal responses. But this I mean that risk management is a reductive abstraction that obfuscates or outright misrepresents protective states. The unfortunate reality is that many decisions we believe to be rational are often post-hoc rationalisations of choices already made on an emotional basis.

Individual Agency

Do humans operate on their own agency? Well, that is a touchy subject. The matter of free will is not as straight forward as you might think. A deterministic perspective will conclude that all actions are predicable when the initial state is known. A non-deterministic perspective will conclude that free will is possible and humans can control over own decision making.

Several experiments show that decisions can be known by an observer using an fMRI scanner 7-11 seconds before a person is consciously aware of the decision they have made. We know that the decision manifests from within the individual but how much of this is generated by sub-conscious processes is up for discussion. In view of the high prevalence of System 1 thinking we can assume that it will be comparable at around 90%.

The philosophical constructs we have devised are rooted within our biological limitations. We perceive that we have consciousness, self-determination, and free will, but it might be the case that consciousness is the first demarcation that individual agency is a post hoc rationalisation. Functionally, it’s more useful to assume that we have free will and self-determination as our societal structures are framed on that premise. Without the assumption of free will then concepts such as justice and punishment become morally problematic to enforce as there can not be any accountability, strictly speaking.

The need for individual agency can be related to biological mechanisms and that is the need to procreate. Individual agency can be an interpretated as both a product of and mechanism for genetic survival. This is described in the book “The Selfish Gene” by Richard Dawkins that argues for individual gene propagation and makes the case that understanding this genetic need can help up make conscious choices to act independently from base urges. This is further supported in neurobiology in the concept of neuroplasticity that demonstrates that the brain has a capacity to change and operate independently from its pure genetic instinct. You can conceptualise that neuroplasticity initially requires System 2 thinking however the process then informs and underpins System 1 mechanisms.

It is the premise of gene propagation that we can understand the emergent requirement for protection, which extends to feelings of security. Individual agency and neuroplasticity also give us adaptability and autonomy that creates a sense of control which is underpinned by hormones such as dopamine and oxytocin putting us in a preferred state. If we consider how Theodore Kaszynski conceptualised fulfilment, then it was the engagement within the power process and autonomy that created it.

Pack animals

We have a predisposition to cooperate with those within an immediate kinship group, and this is by virtue of our construct as societal creatures. Our biology is built on sexual reproduction which necessitates groups or at least the need for a partner temporarily. Persistent groups are advantageous from a survival perspective and offset a number of our limitations. Our necessity to sleep, the inability of our offspring to survive independently further facilitates the emergence of groups where protective duties can be shared.

There is an optimal emotional state that is fostered by relationships and our biology reinforces relationships. Hormones like dopamine, serotonin, endorphins, and oxytocin are responsible for making us feel good and are the expected response to positive relationships. These responses foster trust as is well known within social engineering. Trust is a related concept that is required within groups. We can loosely consider trust to be a belief or confidence in the reliability or truth of someone or something. Trust is a term we use frequently in security but like security it is a perception about an external state.

Perhaps a detour is required to give a brief overview of the key hormones involved. Dopamine is associated with reward and satisfaction. Serotonin is the feel-good hormone that helps you stay calm and content, if you have ever had a white Mitsubishi, you might have experienced serotonin depletion and know the starkness of its absence as we sit crying in a corner. Endorphins are related to wellbeing and euphoria which also serve as a painkiller. Oxytocin is often described as the moral molecule following Paul J. Zak’s book of the same name. It enables us to trust one another and has gained traction in social engineering which tends to place significant emphasis on oxytocin generation through its techniques.

Mirror neurons also play a part in trust formation and provide some of the mechanics. They help us understand the actions of others and allow us to empathise with others. These are more easily activated when we engage with people most similar to ourselves. Studies suggest that there is fluency to the interactions or that as we interpret the actions of others through our own frame of reference then alignment is far easier with those who resemble ourselves. This is basically in group preference. An old Bedouin idiom encapsulates the idea of concentric circles of trust quite well.

I, against my brothers. I and my brothers against my cousins. I and my brothers and my cousins against the world.

It is a reasonable interpretation that good interpersonal relationships and the associated biological mechanisms are correlated with individual feelings of security and provide the basis for how we feel about security. And to paraphrase Alfred Adler, all problems are interpersonal relationship problems.

Adversarial and Conflict Driven

As much as we depend on those in our immediate vicinity, the further we move away from our immediate groups then the greater the differences and the less we trust. The diversification of genetics is desirable when considering the survival of a species. We can view this through the lens of Nassim Taleb’s “Anti-Fragile” and view these patterns are a form of optionality further extending to a holistic system that becomes less fragile as it encounters adversity. Conflict helps remove the fragile elements of the overall system.

The presence of these difference creates competing interests. Where there are competing interests, there is conflict. One group will preference their interests over another. It’s an inescapable truth of the human condition. I have not been alive during a period where one group of humans is seeking dominance over another and neither have you. It is innate. Conflict is the basis of the stories we tell and permeates our cultures. Our societies are based on violence. Our boundaries are drawn in blood and our rules are upheld through the application of force.

There is a rather twee and modern perspective that implies a benevolence to humanity, an inherent goodness. It sees that people are innately good and the bad are the fallen, corrupted by circumstance, victims of society or some other nonsense. It’s a nice thought that all people are fundamentally good and virtuous, but this perspective is predicated on egotism. It assumes that what is good is aligned to the values of the people making the assertion and ignores that different groups can have fundamentally different value structures. It is projection and disregard of the values of others.

We could consider this to be dysfunctional relationship between groups enforcing a victim and persecutor paradigm, but I’d see this as a misapplication of something like the drama triangle. There is a necessity to conflict by virtue of our construct, or at least it is incentivised by our biology. Victory feels good, doesn’t it? If you add adrenaline and testosterone to the list of dopamine, serotonin, endorphins, and oxytocin . . . you have victory. In view of the hormonal response to conflict and the similar feelings of victory to relationships and empathy you might say that we have a very intimate relationship with conflict. Violence is one of our oldest acquaintances. As with the benevolence of relationships, the malevolence of conflict is a pure form of human expression. I am not seeking to fetishise violence, but we need to be honest about what we are and what the human condition is. A core responsibility of a security function is protection. But protection from what or who? It is protection from those seeking to do us harm or enact a form of violence against the organisations we serve. The adversarial nature of humanity is why we are here.

Hierarchical

I’ll briefly touch on hierarchies; but I’ve discussed these a lot in the past. Difference creates hierarchy viz: - We are different and that difference in important as an explanation of social hierarchies. It is a biological necessity to ensure evolutionary development and differences within groups creates a broader range of abilities or traits in which can increase the survival rate of a group.

Hierarchies can create some of the undesirable aspects that we want to protect from. There is a metric called the Gini co-efficient that measures relative wealth inequality. We find that area with a higher score experience higher levels of criminality. We might then consider that large variances in groups in close proximity is not desirable and the natural way we order ourselves into hierarchies has limitations. Too much variation causes a breakdown of relationships an inversion of the hormonal responses leading to conflict from which we would then seek protective measures to restore feelings of security and a return to an optimal state.

Hierarchies emerge yet they are bounded to human limitation and overly tall hierarchies suffer from inefficiency. This can be compared as a form of communication entropy as discussed in “The Human Use of Human Beings” by Norbert Wiener where each step in a chain of communication introduces degradation and entropy. Some organisations seek to work around this by having flatter hierarchies but then suffer from different issues as the lines of responsibility fade or become diffuse. Yet it is from within these structures we find community and connection. Although they are flawed and a product of our biological needs they themselves can give a feeling of security.

Conclusion

Individual agency brings rise to the necessary requirement of freedom which contrasts against the need for protection. We can, perhaps, describe security as the uneasy tension between the biological imperative for protection and a psychological need for freedom. And the tension between these two aspects means that security is dynamic and not static. This of course makes questions about how much protection is optimal impossible to answer without context.

The tension of these aspects is the justification for the liberal conception of the social contract as described by Thomas Hobbes in Leviathan. He describes the state of nature as a condition of perpetual war, where life is "solitary, poor, nasty, brutish, and short" and reaches the position that consensus needs to be achieved to enforce peace using a social contract. Freedom is exchanged for safety in a social contract society.

Liberalism is intellectually bankrupt as it sits upon fundamental assumptions that are untrue. We cannot be both free and equal which a core contention at the heart of the liberalism. The characterisation of the state of nature that these ideas are built from is obviously false although if we are to be generous, we could say it was never intended as a literal interpretation. It assumes an isolation that had not ever have existed. Hobbes makes the claim that we are equal irrespective of differences and dismisses this as a factor, I’d say he is a victim of the “vain conceit of one’s own wisdom” of which decries others. To dismiss difference as an important factor is a denial of reality and a repudiation of truth.

If security is built on the liberal conceptualisation, then what originates its creation? It may be the case that freedom is not the right idea. Prior to liberalism security was based on the stability of hierarchies related to feudal systems or state constructs. The concept of an individual was of lesser importance that the sustenance of the society. Security was tethered to the concept of hierarchy where everything had its place, you knew your place in it and to uphold the system is to ensure your protection and grant you the feelings of security within that community.

This wouldn’t be acceptable as a definition in a modern society as individualism. We can make a case that liberalism is successful however it is in its infancy when considered against the longevity on humanity. Along with the industrial revolution it has bestowed up on us many benefits but also many curses. Never has man had such a capacity to endanger others. Should we feel more secure in a globalised world or in one that is segmented into loosely connected communities?

This is a by-product of the abstracting away of engagement with work that directly relates to our survival needs. Feelings of security evoke similar hormone responses to relationships and trust including dopamine, serotonin, endorphins, oxytocin with the addition of Gamma-Aminobutyric Acid (GABA). So, we might say that security as a feeling is inexorably connected to humanity and a necessity. It’s close relation to core traits of humanity make it a emergent property of the human condition.

So, to answer the question I originally asked. Is there a biological imperative to feel secure? I’d suggest that there is. This feeling is related to many fundamental aspects of the human experience and overlayed with our need for connection with others.

And eventually we arrive at a place where the connection between the biological the psychological, and the philosophical intersect. It’s not a neat picture, there is complexity, nuance, and subjectivity. This might age badly in the face of new evidence, but I would hope that it prompts you to consider things through a lens that you might not have done before.

The world of information security and cYbEr now seems like a malaise of dysfunction to me. Maybe this is the point where I have gone ‘Full Tonto’. Have I strayed so far off the reservation that I might now be better suited living in a shack in the woods stripping batteries to satisfy malevolent intents?