One of the toughest and most insightful lessons I learned came during a conversation with a good military buddy about why English is such a difficult language to learn. "You never mean the things you say. You say you "love" your car in Spanish, it means you love it like family. It's as if you use the words so much they lose their actual meaning." I was a bit taken aback by this. No one had ever explained the issue of semantics so eloquently before to me.
This same thing happens in security and explains what makes it so difficult for so many professionals and lay-people to be able to comprehend it. The following are great examples:
- Prevention versus mitigation. Prevention is defined by Websters as "the action of stopping something from happening or arising." Mitigation is defined by Websters as "the action of reducing the severity, seriousness, or painfulness of something." The words mean something completely different from the other, yet are used interchangeably. In security, getting these two words wrong can mean the difference between a loss of life (yours or an innocent) and victory over an attacker. Having lofty goals of prevention through methods and measures seldom tested with actual bad actors, often leads to failure when they do show up. However, having sound mitigators in place should they attack, could save both life and property and result in the consequential capture of your bad actor. The decision to stop his or her actions is totally dependent upon his or her decisions and plans before and during the attack. Your measures could help persuade them not to attack but I would hardly call this prevention without more quantifiable evidence.
- Vulnerability assessment versus reconnaissance. A vulnerability assessment is a process which entails analyzing a client's assets to determine likely avenues of approach for attackers. It could involve talking to stakeholders, physical walkthroughs of the assets, imagery analysis, and red-team exercises. Reconnaissance is a process which entails some covert surveillance resulting in a report to the target's adversary to support a plan of attack on the target. These terms are often confused because people assume one means the other. Typically, bad actors do recon and friendly agents do vulnerability assessments. The latter could use the former as part of a red-team exercise or even as part of a walkthrough. However, the methods by which either is done are very different. Keeping this in mind prevents amateurs from thinking by doing reconnaissance, they are in some way doing a complete vulnerability assessment.
- Security versus protection. It grates my nerves to hear people say they are "doing security". I find most people have no true understanding of what the term means and are therefore, ill-suited for and failing miserable at the task they think they are doing. As I've discussed before, security is a mental construct wherein our protective measures are adequate enough in our minds to mitigate bad actors and their attacks to make us feel secure. It's a subjective term but more of a goal and less of an action than anything else. Protection is what we do to make the environment secure enough to assuage our fears of a possible attack.
- Arrested versus detained. It took me a while to get used to this. They both sound like they should mean the same thing but they do not. Ask anyone who has ever been arrested. Being arrested has an element of detention but it isn't the totality of the action. You can be detained without being arrested. While this may sound like an issue of semantics, ask your legal counsel to explain what happens in security when you confuse your ability to detain versus your arrest powers.
- OPSEC. OPSEC is one of the latest buzzwords to come into the modern security lexicon. Everyone believes they do it but few actually do to include me at times. Seriously, everyone on social media who is in our industry seems to have a burner cell phone number, 10 fake IDs, wall safes for their wall safes for the wall safes with their encrypted USB, uses TOR to hide from the NSA (as if), etc. The first rule of being good at operations security is to shut up about OPSEC. What's the first thing people do when they think they've done something awesome with respect to OPSEC? They tweet about it on a source they don't own with people they don't know or could vet with any realistic degree of certainty, using communication they know very little about on the Internet which was created by some of their adversaries who have actively engaged in intelligence operations here since its inception. So if so few get it, why do they think they've adequately protected themselves? See the difference between prevention and mitigation.
- Intelligence versus information. I often hear professionals claim they have "intelligence" on adversary, when in fact they don't. Most often they have only raw information they haven't vetted or analyzed. These colleagues suffer from the correlation paradigm where they mistakenly conclude correlating or parallel information to an event is the cause. In the analyst world, this is called "confirmation bias". You believe the information because it confirms what you believe. Intelligence is the product of taking that raw information, vetting its source, comparing and contrasting that data against previous data and assumptions, peer reviews, and a final reporting of that information with an analysis centered on critical thinking. A newspaper article in and of itself is not intelligence because it says something we already thought was true. That would be akin to treating Weekly World News' stories on aliens consulting a still-alive JFK on Elvis' newly proposed welcome-back world tour as intelligence because you're an Elvis-loving, conspiracy theorist who believes you're an alien-abductee.
- Guard versus officer. I'm sure to stir up something here. Let me clarify: there is NOTHING wrong with being a "guard". However, traditionally, that word has gotten a bad reputation. Think "mall security guard". These guys can be awesome professionals but the title does tend to minimize the extraordinary amount of work it takes to protect the thousands of mall patrons and mall assets against a variety of threats daily. It also does little to note the authority which enables them to perform certain legal actions against those threats such as trespass advisements and in some cases, arrests. "Officer" denotes they are an extension management and not merely someone who stands a post. They represent the extent to which managers are willing to go to protect their assets and their customers.
Recently, during a discussion with another friend from the military, I recalled a conversation about semantics with a person who worked in what was commonly referred to as the "chow hall". One day, I inquired why the name "chow hall" was such an insult to him. He explained "Do you guard planes or do you protect assets vital to national security? I don't cook chow. I cook meals which are nutritious as per my training. We're both professionals. I know people mean no harm but that term implies my food and what I do as a professional are sub-par and unworthy of a professional title, when that's not true." Vets, I hear the snickering. Stop laughing. But he had a point. One that wasn't lost on me.
How your customers see a "guard":
An image the term "security officer" typically conveys:
- OSINT versus unclassified. I'm a huge supporter of open source intelligence (OSINT). This entails gathering intelligence from a variety of non-covert channels. This could include public radio, news broadcasts, social media, etc. I have noticed this word used to excuse what I believe to be gross violations of protecting classified or sensitive information. Let me explain. I certainly understand OSINT by its nature can come from unclassified channels. However, I also realize it does not negate professionals from their responsibility not to divulge information coupled with their "insider perspective" which may be tactically advantageous to an adversary. You can observe this lack of professionalism best on social media, during a critical incident. There's seems to be a pandemic of sorts when these incidents happen which encourages its victims to feed their egos by talking endlessly about their highly sensitive "insider knowledge". I, once, observed someone who is widely considered an "expert" tweet the locations of responding forces to a major hostage situation. Another person tweeted security measures at a base they just left. Sure, none of this was classified because it came from a radio scanner and personal experience. It was, nonetheless, highly sensitive and could have placed lives at risk, if the adversary had intercepted these messages. In the physical security, once sensitive information is compromised, we only have a precious, small amount of time to deploy mitigators. As I'm often say during these events, "Don't let your ego and mouth write checks your a-- can't afford to cash with someone else's collateral."
We've moved a table to barricade the door into this room. pic.twitter.com/FXj33EynxE
— Federico Barillas S. (@fgbarillas) October 3, 2013 - Active shooter versus mass killing. The best way to explain this is simply stating not every active shooter kills anyone and not every mass killing involves a gun. Yet, whether because of politics or hype, professionals and laymen still confuse these two. This may seem meaningless until you realize how information is gathered to study these two distinct events and the influence those studies have on policy.
- Security theater versus threat mitigation. Look, folks, as professionals, we realize not every threat is going to attack us. We also get some of our measures are extreme. I'm certainly NOT trying to justify any abuses of authority or trust. That being said, just because you don't see the "boogey-man" doesn't mean he's not there. Does this mean security should have authority to do cavity searches on everyone? No. But it doesn't mean because that's extreme that someone isn't trying to do you harm. Do some threats get blown out of proportion? You bet. A vigilant public and other professionals are awesome checks against overreach, though. As every threat isn't realistic, every threat mitigator isn't security theater. We'd all do well keeping this in mind.
There are a load of others I would add but I feel as though this list does a great job of illustrating the power of words in our industry. Please use them carefully. If you have more, let me know.
