VIEW 18
The liminal zone: octopus vs ant
A murmuration of starlings is an example of a biological organism that exists right at the boundary between the individual and collective. Should we view it as a single super-organism or is it just a collection of separate individuals? Is it one thing or many? The answer is both, or maybe a better answer is that there is no such thing as a borderline. Instead, there is a liminal zone where one blends into the other.
There are other examples of creatures that exist in this liminal zone—ants, for instance. We are accustomed to think of ants as individual entities. In Aesop’s Fables they are heroic singular examples of the benefits of hard work and industry. But ant colonies show a high degree of internal specialization, a division of labor between workers, soldiers, gardeners, carers, and queens.
The colony itself can be viewed as a single super-organism in the way that it eats, attacks predators, build nests, and moves to new locations. The ants in a colony have been shown to behave like neurons in an aggregated brain7. Ant colonies, at the group level, also exhibit different personalities8 and, in fact, show so many collective traits that they are often best understood as a unity.
An octopus sits just on the other side of the divide. Using the evidence of our eyes, it appears to be an individual creature, but scientists have discovered that each of the eight tentacles has its own brain, independent of the others. Should it be viewed as eight different creatures writhing in a single skin?
Moving across to the corporate world, a law firm could be seen as an ant colony, a denizen of the liminal zone.
In a small law firm, lawyers are typically responsible for their own customer relationships. This approach means they are like a bunch of individuals only loosely connected into a collective whole.
Alternatively, think of a multinational holding company with several different divisions, product lines, departments, and geographies. Such an entity could also be called a creature of the liminal zone, depending on the degree of overall central control—an octopus with its tentacles everywhere.
This blurring of the boundary between the individual and collective has implications for cyber risk modeling.
Take as an example a group of accounting firms, all using the same enterprise software package when providing services for customers.
For insurers, each firm is viewed as a separate risk. But the NotPetya attack of 2016, triggered by a compromised Ukrainian tax software package, might suggest we should think of them as a single entity. At the other end of the spectrum, consider a large multinational with highly segmented networks. Network segmentation is implemented at the lowest levels—level two in the seven-layer hierarchy of the ISO model. Is that multinational a single risk, or a collection of much smaller ones?
The answer may turn out to have a significant impact when modeling portfolio risk in aggregate.
