All 100 indicators / Category 8.x: Unconscious process
Indicator 8.2
Measures the degree to which security professionals unconsciously adopt characteristics, methods, or mindsets of threat actors they defend against, creating insider risk through identification with attackers
Security professionals who spend extensive time analyzing attack methods may unconsciously adopt attacker mindsets, tools, or values. This psychological shift creates insider risk as defenders blur boundaries between understanding threats and identifying with them. Organizations experience policy violations, scope creep in testing, and gradual erosion of security controls when team members unconsciously mirror the behaviors they're meant to defend against.
Anna Freud's (1936) concept of 'identification with the aggressor' describes how individuals adopt characteristics of threatening agents as a defense mechanism. Klein's (1946) projective identification shows how individuals project aspects onto others then identify with those projections. Mirror neuron research (Rizzolatti & Craighero, 2004) demonstrates automatic neurological simulation of observed behaviors, creating potential for unconscious identification.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Tools selected based on documented business requirements. Balanced participation in offensive and defensive security communities. Incident analysis focuses on victim protection. Security team follows same policy procedures as other employees. Professional communication emphasizes organizational protection over technical admiration.
Some tool decisions based on technical appeal rather than business requirements. Heavy focus on offensive security training with minimal defensive skill development. Incident discussions show significant interest in attack sophistication. Occasional informal policy exceptions for security team members.
Tools selected primarily for technical sophistication or hacker appeal. Disproportionate engagement with offensive security communities and hacker culture. Incident response delays while team analyzes attack techniques. Regular policy exceptions for security team. Frequent use of hacker terminology and admiration for attack creativity.
Implement mandatory business case and security review for all security tool adoptions with focus on organizational protection rather than technical features
Require documented justification for all tool adoptions emphasizing business requirements and organizational protection needs. Include approval workflow involving non-security stakeholders to maintain business perspective. Implement quarterly review of tool usage versus stated business objectives. Establish criteria for tool evaluation that prioritize defensive effectiveness over technical sophistication.
Establish 60/40 split between defensive and offensive security training, mandate participation in victim-focused security communities
Create career advancement criteria rewarding defensive achievements equally with offensive skills. Mandate participation in incident response, business continuity, and privacy protection communities. Establish training budget allocation requiring 60% defensive/organizational protection focus. Include business impact and stakeholder communication skills in professional development requirements. Track and report on training balance quarterly.
Implement structured incident response procedures with mandatory timelines for containment actions before technical analysis
Establish clear incident response phases with containment required before detailed technical analysis. Create mandatory containment timelines based on incident severity. Require post-incident reviews evaluating response effectiveness rather than attack sophistication. Implement automated incident response workflows enforcing phase transitions. Train team on victim protection priority over technical curiosity.
Apply identical policy exception procedures to all employees regardless of technical role, eliminating special treatment for security team
Require security team members to use standard IT request processes for all tool installations, access requests, and policy deviations. Implement peer review for all security team policy exceptions. Track and report security team exception rates versus other departments. Establish clear consequences for informal policy bypasses. Create organizational culture emphasizing that security team models policy compliance rather than receiving exceptions.
Establish communication guidelines emphasizing organizational protection and business impact in all threat discussions
Create communication standards prioritizing business impact over technical details when briefing non-technical stakeholders. Train security staff to focus on risk and mitigation rather than attack techniques. Develop templates for threat reports emphasizing organizational impact and recommended actions. Conduct quarterly communication audits assessing business impact focus. Provide coaching and feedback on communication effectiveness.
Require pre-approval for all external security-related activities with clear boundary management and conflict of interest assessment
Establish pre-approval requirement for all external security activities including research, speaking, blogging, and community participation. Create clear boundaries between personal interests and professional responsibilities. Implement conflict of interest assessment process for external engagements. Require annual disclosure of external security activities. Establish oversight process for ongoing external commitments. Define prohibited activities that create inappropriate boundary confusion.