A Tale of Two Triangles — So What Can We Do?

This has been quite a journey, I realize. We have explored both the danger and the potential of the Human Triangle. We have seen how Pressure can cause people to decide to exploit Opportunity, thereby committing fraud or even doing violence, Rationalizing all along the way.

If this is all we focus on, things can seem pretty grim. What can we do, in addition to applying our three (admittedly oversimplified) ethics tools (Center of Moments, Golden Rule and Living Well Together)? (1)

I’m going to introduce a second triangle, well known among cyber security professionals.

The Security Triangle, sometimes called the CIA triangle, comprises the three elements you see here: Confidentiality, Integrity and Availability. By adhering to the Security Triangle, we seek to protect information. Confidentiality ensures that that information is kept from prying eyes (or machines), only allowing those who are entitled (or authorized) to access it. Availability ensures that our information systems are robust enough to provide information to individuals when they need it. And Integrity ensures that the information isn’t changed through unauthorized modification.

For our purposes here, I’m going to present the Security Triangle a different way:

I’m proposing this pyramid view because I want you to think of the Security Triangle in a non-traditional way. Instead of seeing it as a tool for how we act on information, think instead of the three elements here as standards of personal conduct.

That’s why this looks something like a pyramid: each level builds on the one beneath it (although there is obviously freedom to move between them).

In addition, where the Human Triangle is transactional, governing our day-to-day behaviors, the Security Triangle as shown here is aspirational. We strive for Integrity, Availability, and Confidentiality. While we may trip ourselves (or be tripped by others) along the way, it’s the striving that matters. It helps to think of Integrity, Availability and Confidentiality as aspirational behaviors that counterbalance the transactional elements of Pressure, Opportunity and Rationalization.

How can these aspirational behaviors help us? Let’s start with the foundation level: Integrity.

Integrity may be one of those words whose meaning vanishes upon reflection. It’s kind of like the old saying about art: “I don’t know art, but I know what I like.” We might say, “I don’t know how to define someone with high integrity, but I know one when I see one.”

Better yet, experience rather than see. We’ve all had the disappointment of being betrayed by glittery outward appearances. As highly visual beings, it’s easy for us to be hoodwinked by what our eyes take in, or by what someone says. There’s that old saying, “Handsome is as handsome does.”

A high integrity person doesn’t declare their integrity; they demonstrate it. They reassure us through consistent decisions and behaviors. They cultivate trust which, like a delicate plant, takes a great deal of care and nurturing and can be turned under or killed by the careless boot of betrayal.

While trust-building actions accrue over a long period of time, it can take as little as one betrayal to shatter the whole structure. It’s why I sometimes refer to trust as a glass bridge: strong and beautiful, but also delicate and prone to shattering.

This is why the “I” in the Security Triangle is essential. Many years ago, I had the good fortune of working with a colleague, Bill Traster, who was incredibly knowledgeable about security, risk and audit. Sadly, Bill passed away several years ago, just after retiring and far too young. In his eulogy (1), I simply said of him that he was the “I” in the CIA triangle. You might have disagreed with Bill on certain things, but you knew where he stood. He treated people as he would have wanted to be treated himself. He was consistent. He was, essentially, trustworthy.

We are watery bags of disharmony. We strive to do good things while often accidentally, sometimes deliberately, straying from our personal “good path.” Our ethical arguments constantly evolve, as we work through complicated problems whose initial solutions may seem obvious but, when applied, result in unintended consequences.

Thus, personal integrity is a journey. That we sometimes make mistakes, however large or small; that we sometimes lie down on the burning bed (2); that we sometimes passionately argue for solutions which themselves bring unintended harm or grief — these merely remind us that we are frail and fallible beings moving through a complex interdependent world.

During this journey, our actions and behaviors are critical. If we are in leadership positions, we are scrutinized far more than we might like. In this age of social media-inspired discord, there are always those taking aim. They well know that the glass bridge of trust can be shattered by the placement of a well-aimed stone. They well know that how easy it is to make loud accusations whose effectiveness rests on the notion that it is far more difficult to prove a negative — that the accused has not done what the accuser has proclaimed. (3)

Integrity is the foundation. Trust rests upon this foundation. But we must also acknowledge that personal integrity is a goal which, like many goals, moves out of reach as we approach it. “For all have sinned…” It’s easy in this world to point out what we perceive to be the moral faults in others, failing to realize that as we do so we risk tarring ourselves with the same brush. Not for naught did Jesus say that if we would remove the speck of dust from our neighbor’s eye, we should first take the log out of our own.

The second layer of the Security Triangle is Availability. We normally think of Availability in terms of data or information — ensuring that information is available to people who need it, when they need it. However, here I’m talking about personal availability. I’ll illustrate with a story.

I once worked for a very busy IT executive, whose responsibilities included shaping IT strategy for a multinational corporation. He had plenty on his mind. Still, if you knocked on his door with a problem, he would do one of two things. Either he would ask you to wait for a moment so he could finish the task at hand; or he would invite you in. Once you were seated across from him, you had his undivided attention.

He had made himself available to you.

This is the first form of Availability. You show respect for people by making yourself available to them. Why is this important? Consider this scenario. You’re talking to someone about something you think is important, and the other person is distracted by someone else entering the room, a cell phone call, incoming email, and so on. How did that make you feel? Some would argue that distractions are a way of modern life, so we should just get over the feeling. But that shifts the burden to us. It also can lead us to wonder whether what we have to say is somehow not that important or relevant. It can chip away at our self-respect.

Making yourself available, listening to understand and learn instead of listening to answer or to rebuff, is more difficult. But it signals our respect for the other person. It is a way of building trust through conversation.

The second form of availability also requires self-discipline. This involves making yourself available for criticism, available to consider other points of view. I personally find this difficult to do — I’m notorious for defending the way I’m doing things, the ideas I’ve had, the conclusions I’ve reached journeying down my own corridors of reason. For me, it’s both challenging and crucial to receive honest feedback, to try to understand alternate points of view.

In our journey through life, we discover that there are many possible answers for the challenges presented to us. I like to use COVID as an often-controversial example. While there is a ton of information and misinformation on the topic, that’s not the point of this example. Instead, look at the options that presented themselves — lock down, lock down partway, vaccinate, don’t vaccinate, get or stay healthy, stop smoking, on and on.

What tended to happen was polarization. While this may be useful for selling media clicks and providing fodder for politicians, it wasn’t particularly helpful in solving the many facets of this massive challenge. Often complex problems are best attacked by using as many tools as possible. While it may seem nearly impossible to accommodate multiple perspectives and suggestions for how to do things, it’s best to try rather than end up in separate camps expending energy by slinging arrows at one another when the common cause demands a more consistent, concerted effort.

As you may remember, at the COVID outset fog of war prevailed. Information was sketchy and often contradictory. We learned by doing.

Navigating through this mist requires that you take some first criticial steps and then remain open to course changes. No matter how loudly people may clamor and complain, no one has answers yet.

This second form of availability demands that you be open to reassessment. As anyone in leadership can tell you, reassessment is vital. Situations change. New information arrives. Unforeseen consequences require course corrections. All of these developments demonstrate that to continue down a corridor of reason may well be treacherous, even contrary to what we thought we were trying to achieve in the first place.

In today’s world, “doubling down” has often been hailed as taking a strong stand. “Sticking to your guns” in the face of adversity, winning at all costs, no compromise, unconditional surrender, give no quarter — all of these are phrases we associate with strength. Yet often we are stronger if we admit other opinions. Although I try to avoid military references (as a personal preference — these are way overdone in our business discourse), the best generals re-evaluate their positions and adjust their tactics based on changes in battle contours.

This second form of availability — willingness to be open to criticism, willingness to entertain other points of view — can be a source of strength. At the very least it serves to break through the potential prison of rationalization. Painful as these breakthroughs may be, they are needed if we are to progress beyond angry and divisive conflict.

Finally, there is Confidentiality. I left this for last, because I believe Confidentiality as I describe it here relies upon both Integrity and Availability.

In the cyber security world, Confidentiality refers to the preservation of limited access to information based upon need to know, or privileged access. However, here I’m discussing the confidentiality of human interactions. Put another way, this is the confidential exchange of private information between two individuals.

I hasten to add that confidentiality in this context differs from the popular notion of “confidence person.” After all, you can earn the trust of a mob boss. But you’re likely to have sacrificed either your center of moments, the Golden Rule, or the notion of Living Well Together to get there.

This is different. You earn interpersonal confidentiality through repeated, observable acts that demonstrate your personal integrity as well as your willingness to be available in both ways, as mentioned above. Only through this history of ethically consistent activity do you earn the trust and confidence of others.

Let me clarify something. Here are some examples of what I call role-based confidentiality: your doctor, your lawyer, your pastor — even a journalist, if you have an important story that may be dangerous to share publicly (4). There is an expectation of confidentiality based upon the role played by both the giver and taker of information. Often this role is established through a code of ethics. We’ve seen examples of journalists willing to risk jail time rather than betray a source (5).

That’s role-based confidentiality. What I describe here instead is much more spontaneous. It arises because you’ve been observed as journeying toward (and therefore demonstrating) personal integrity. It arises because you’ve been observed as being approachable. It likely will happen rarely during your career. But when it does, there are two things you may feel all at once. First, you’re honored that someone is investing so much trust in you. Second, you’re humbled. This is, after all, a huge responsibility.

For this reason, Confidentiality is at the top of the pyramid.

Let’s illustrate this with a story problem. I’m giving you a homework assignment.

First, imagine a situation where you have had a long-standing relationship with your neighbor. You and your families are roughly the same age. Your kids have played with your neighbor’s kids. You’ve done other things together, perhaps camping. And you’ve watched your neighbor’s kids grow up, even going off to college and then coming home for the summer.

One summer, you’re in your backyard reading a book. Your college-age neighbor’s daughter comes over and says, “I need to talk to you.”

You put down your book. “Sure, what is it?”

“Not here.”

At this point, your mind should be racing. Something’s very wrong. You can see it in her eyes. You’ve probably already guessed. Nonetheless, you take her inside to your home office. She sits across from you. You make sure tissues are handy. She begins.

“We thought we were being careful.”

She then pours out all her fears. She’ll have to quit school. Her father will disown her, her mother will hate her. She’ll be shunned at church, in the community. Her boyfriend will run away. On and on. She is considering all her options, from keeping and raising the child, adoption, and abortion.

On her fifth tissue by now, wiping her eyes, she looks at you.

“What should I do?”

While your mind is racing through options, sorting out your own thoughts on all of this, one question rises above all others. Given everything we’ve discussed in this long journey — the three foundations for ethical behavior, which are your own inner center of moments, the Golden Rule, and Living Well Together; the Human Triangle, with its Pressure, Opportunity, and Rationalization; and the Security Triangle, consisting of your personal Integrity, your Availability to have this conversation, and the Confidentiality of this most intimate and important conversation — Given all this:

What will you do? How will you answer?

That’s your homework assignment.

And for extra credit: You live in Texas.

We’ve come to the end of this long journey. I hope it’s been both informative and in some small way, useful. We’ll summarize and wrap-up in our final discussion next week.

=============================

(1) I’ve only written two eulogies in my life. One was for my mother. The other was for Bill.

(2) From the book, “It Was On Fire When I Lay Down On It,” by Robert Fulghum. Here is the opening to that book — and if I do nothing more than introduce you to Fulghum’s gentle but deep philosophy, I’ll have accomplished a lot:

“A tabloid newspaper carried the story, stating simply that a small-town emergency squad was summoned to a house where smoke was pouring from an upstairs window. The crew broke in and found a man in a smoldering bed. After the man was rescued and the mattress doused, the obvious question was asked: ‘How did this happen?’ ‘I don’t know [the man answered]. It was on fire when I lay down on it.’ “

(3) This is why there is a presumption of innocence in our legal system. It’s easy to accuse; far harder to prove it. This fact seems to be forgotten on a daily basis by many media forms

(4) I’m not including close friends or life partners in these examples. Indeed, many of the situations that rupture these relationships have less to do with a misdeed and more to do with the betrayal of confidence that the transgression represents. This may in some sense be why we say that the cover-up is often worse than the crime — we’re more tolerant of mistakes, because we all make them, and less tolerant of the actions to hide our sins — which we all do as well.

(5) We may not hear as often those cases where confidentiality is betrayed. One of the more poignant and tragic illustrations of this is in the classic film, “Absence of Malice,” in which a woman’s confidence is betrayed and (spoiler alert) this leads to her suicide due to shame — shame being perhaps the most powerful emotion of any we harbor in our hearts.