What's Your Basis For Trust Today?
Fred Cohen
Cybersecurity Board Member for Your Public Company / Trusted Advisor / Cybersecurity Guru | We Help Grow Companies
SUMMARY: This article discusses the challenges we face when deciding how to build a model of trust - with individuals or organizations - in the modern world.
The Basis For Trust
Trust is being questioned by many folks because of the political situations around the globe. In the field of security, there has long been research in this area, and many results have been published with plenty of statistical and related basis.
It has also been studied in sales and marketing, influence operations and deception, psychology, sociology, and elsewhere. I won’t cover it all here, but I will cover a starting point.
Organizational Trust
Trust by organizations is a bit different from trust by individuals, societies, lovers, parents and their children, family members, etc. This very fact points out that the whole notion of trust is relative to the issue at hand.
Trust for what?
More specifically, I ask the question “Trust for what?”.
- I trust most people not to kill me in my sleep. So if I nap off in the park on a bench, I feel confident that I will not wake up dead.
- I trust people on airplanes not to rifle through my luggage when I leave it in the overhead bin and fall asleep in my seat.
- I trust restaurants not to try to poison me, so I eat what they make without that fear, even though I have had bad food from time to time at restaurants.
- I trust my wife with access to our bank accounts, but I don’t grant her access to the corporate accounts, not because of a trust issue, but because of a legal requirement.
- I trust some folks who work with me with access to some of my trade secrets, of course taking proper contractual and other precautions per reasonable and prudent policy.
- I trust Google with emails I send and receive, included limited time storage of those emails and tracking of the contact lists associated with them.
- I trust my accountant with read-only access to my bank accounts and my personal financial and related information.
Context has a great deal to do with trust. And that’s one of the two key points of this article.
Trust should always be relative to a context. Trust for what?
Why Should I Trust?
Given that I have a business reason to grant people authorities to see and do things, and given that I may be harmed by the things they see and do, I have to trust them to do the right thing with respect to the things they are able to see and do in order for them to do their work.
A reasonable question to ask is the basis for allowing them to do me harm, or in other words, the basis for placing trust in them with regard to things they see and do. Different bases for trust should reasonably be associated with different things they see or do.
From a legal standpoint, and from a rational standpoint based on the research that has been done, the basis for that trust should not be they way they look, the way they talk, the way they walk, their sex, religion, sexual preference, or any of the many other things that form the basis for the irrational elements of human trust.
It doesn’t matter that I love and trust my wife, she cannot have access to business-owned trade secrets because that would violate legal requirements for asserting and retaining their value as trade secrets, as well as my contractual obligations to others.
A Trust Model
My approach to forming a basis for trust is to build a trust model for my business (and yours when I work for you to help you do this). The basics of these models are different bases for trusting businesses, people, systems, and content for different purposes at different consequence levels. For example,
- I might reasonably decide to trust businesses in situations of high consequence based on transparency, historical behavior, expertise, systematic background checks, external clearances, contracts, nationality, group membership, investigations, certifications, and size to perform on government contracts.
- I might trust people in situations of low risk based on transitive trust chains (a friend of a friend recommended them) to do website design.
A critical component of this sort of trust model is that it should apply uniformly to all businesses, systems, content, and people. So regardless of other issues, I would reasonably have to decide to trust any friend of a friend for low consequence website design if recommended.
If that isn’t good enough, its the model that has to be improved, because as a matter of policy and good governance, if I cannot identify a basis for trusting one entity over another for any particular purpose, I don’t have a rational (or sound) basis for trust.
Failing such a basis, I leave my business to make decisions based on personal preferences not codified in policy, or in other words, open to arbitrary and capricious decisions, legal liability, and other bad things, and perhaps more importantly, it leads to bad decisions.
Trust But Verify?
Just because I made a trust decision based on a defined basis, doesn’t mean I make all good decisions and it doesn’t relieve me of the obligation to verify that the trust placed is justified by performance over time.
Which is to say, trust but verify. And verify with a level of rigor and frequency based on the consequence of failure to meet the obligations associated with the trust.
And if you find that the trust model is not making it, fix the trust model and re-evaluate all of the trust you have placed to date.
Conclusion
In conclusion, trust businesses, people, systems, and content within limits and for particular purposes.
Codify the basis for trust in a trust model that meets legal, regulatory, and business requirements (including the duty to protect), apply it uniformly, and verify it is working.
If it’s not working, fix the model and revisit the trust you have placed to correct any deficiencies.
In the broader context, this applies to all of life. Identify a basis and purpose for placing trust.
Make it harder to trust when consequences are higher. Verify your trusts, and if misplaced, take away the trust you placed, change your trust model, re-evaluate, and adapt other trusts.
CEO, iTristan Group
6 年Good points to consider . "And if you find that the trust model is not making it, fix the trust model and re-evaluate all of the trust you have placed to date." This is key - the trust model is broken. Very much so. We have an expression here called Entity Validation; and at the moment Entity Validation in the world is largely based on 18th-19th century processses with a few computers in the middle, but otherwise our trust model hasn't changed a whole heck of a lot and with that our trust in who, or what, or when, or what access, those entities have to us, our families, attention, information, and lives is sorely challenged. It needs a new model which will begin with acknowledging a new way of thinking about it.
Great point around "trust" Fred... I believe that the baseline of trust is having an open mind to new experiences & the growth that will come from them. With that baseline, the possibilities are unlimited! #HopeIsNotA Strategy
CEO of Cyber Curio LLP
6 年Assigning trust level is horrendously complicated in modern world because people more and more often interact by using technology (e.g. computers). You may fully trust a person (e.g. your wife) but in reality you have to trust everything that touches sensitive information while it's being accessed or moved (e.g. your wife has a smartphone with some software that you know nothing about). Similarly, you may have good trust for some computer system (e.g. it runs a TEE with only signed software) but ensuring correct access by only trusted humans is a separate problem. Research of information flows in combination with trust levels of everybody and everything involved in the transmission chain can likely benefit from more work.
Security Engineer presso Poste Italiane
6 年I think this is a difficult topic to deal with people who do not know each other, but that's why it's important to do it.So thank you for proposing it. I do not think my answer will please you, I'm not a scientist and I still have a lot to learn from both the wise and the crazy (as a famous song says). Knowledge is the basis of trust, but knowledge must be on both sides, otherwise we risk judging a book by its cover. Business models are cold and are based only on numbers and equations, but trust is a feeling and if you really need to calculate it, you must also include in the calculations the number that is based on the ability to feel the feelings, to the extent that each individual it's done. I do not believe that there is a business model based on feelings, on all feelings. For example, if I love my job and love is more important than money, it's impossible for me to betray my employer's trust in money. The more we are able to experience feelings, the more we are guided by them. To a person who can not prove anything, I would not trust anything. I remember a boy who had to deliver the theme in class for his examination; The title of the task was: What is courage? The boy after a while gave his task with only few words written "For me this is courage" It was to be rejected because it completely lacked the form, which was a fundamental thing, but the substance had certainly passed the form. and so he was promoted. The nice thing about this story was not the trust between the boy and those who had to judge it, in fact they did not know each other, but the trust they had both at the end. And in the end for me trust was deserved by both parties. That's why today this story someone, like me, still remembers it.
Assistant Attorney General* ? Advocate ? Author ? * General disclaimer: Kindly note that views expressed on here are my own and may not necessarily reflect those of my office. Thank you.
6 年Same concept as the credit reports system maintained by the 3 credit reporting agencies, Experian, Equifax, and Transunion. They continuously track our financial decisions and actions and produce a report of our financial “trustability” to creditors and lenders. We all have a “score” and the higher the score the more trust-worthy we are!