As a follow up to last week’s article, we had the opportunity to interview Dr. Mark Wells and Dr. James Tippey on the importance of good character in cybersecurity. Dr. Wells has a background in ethics and philosophy while Dr. Tippey has a background in both cybersecurity and religion; together, they teach Cyber Ethics for the Carolina Cyber Center.
Interviewer: Let’s talk about character. How would you guys define character, specifically, good character?
Dr. Wells: Character is a state of the soul, according to Aristotle. The soul is the inner person, the inner being, or the essence of who you are. I believe character is a state of what is essential and stabilizing in one’s innermost being. It guides our actions and even the way we think about things. I think some aspects of the soul are essential and unchanging, while other things, like character, can move and change. Character is a response or reaction, influenced and fed by our experiences, our thoughts, and by the people and situations we encounter.
Dr. Tippey: When I think of character, I think in a more tactile way. I think of character as our ethics, our “positive values”, in action. Character is the way we act out the code of ethics we hold. I agree with Dr. Wells completely, but I also think of character as the way we act out our internal beliefs.
Interviewer: As instructors, how do you attempt to develop students of character?
Dr. Wells: This is the million-dollar question. Character really can’t be taught, but it can be learned through modeling. Traditionally, character has been taught in three ways. Aristotle says you shape character by habituation, by practicing the same thing again and again. In his book A Community of Character, Stanley Hauerwas talks about our propensity to take on the character of the community with which we most associate. If that happens to be a church, you might take on Christian character. If it happens to be a political party, you’ll be shaped in terms of political culture. Finally, there’s what I believe Jesus modeled: the discipleship model. This involves doing life with someone and modeling what life should look like. Essentially, it’s mentorship. The Holy Spirit comes alongside Christians today to guide them in this kind of discipleship. However, that can be applied to mentorship in all professions.
Interviewer: Why is character important to cybersecurity?
Dr. Tippey: It comes down to the question we keep hearing from CEOs and CIOs: ‘Do I trust the cybersecurity professionals that I am hiring?’ I hate the fact that we have to ask that question but it keeps coming up. Cyber professionals are given access to everything, but executives are wondering whether they are trustworthy. From a personal story, we had a junior network administrator at one company I worked for. My boss and I came to the decision that we didn’t trust him because of his behaviors, which we not consistent with our company values. We ultimately went to HR and had a very awkward conversation with HR about letting him go. When they asked why, we had to outline that we just don’t trust him; he doesn’t have the character that we need in such a critical position. In the end, we did end up letting him go for this reason. This matters a great deal in business. Character is incredibly important for cybersecurity professionals because of the sensitive nature of the work you do, such as the sensitive systems and data your called to protect 24/7.
Dr. Wells: The other issue is that cybersecurity is a high-pressure business. High pressure, high stress, gut decisions reveal character and take good character to manage. We act out of who we are, which is what ethicists call one’s ethical reserve.
Dr. Tippey: Cyber most definitely is that. I can think back to multiple situations when your reserve is all you have left. You’re going to act out of your character.
Interviewer: What’s a discernment process in seeing whether a cyber professional has good character?
Dr. Wells: This is a really tough question. In part, it’s how people carry themselves and what they spend their time doing. It’s also in the way they talk about things and whether or not they are responsible. It takes good character to recognize good character.
Dr. Tippey: I would echo a lot of what Dr. Wells said. In the company I worked for we let the gentleman go because there was a lack of character. It wasn’t a big thing like leaking data. Discernment comes in much earlier when you watch how someone presents and carries themselves, or how they respond when you ask them to do unpleasant tasks repeatedly. How they do with monotonous tasks speaks to character when you can see how they approach it.
Interviewer: It sounds like what you both are talking about is character that is seen in the way someone acts when there’s no social or performance pressure. Perhaps character is shown in the extremes: both the high stress and the low stress.
Dr. Wells: That’s right. It comes out when you’re not thinking about character. It’s easy to display good character when you think people are noticing.
Interviewer: For our last question, what’s your advice to a young person who wants to develop their character?
Dr. Tippey: My advice for them is to find somebody of character to mentor you; find somebody to help sand those edges. We all have rough edges, pieces that we could do better on, so find somebody to emulate and interact with, to mentor you in a real and caring way. These people come alongside you and walk with you. While that’s for cyber professionals, it’s also for all of us. Don’t be the smartest person in the room. Instead, find somebody that can help you be better.
Are you interested in mentorship and training from the Carolina Cyber Center? Don’t hesitate to contact us with your questions or apply!
