VIEW 35
Flow vs place: processes not things
Think of a map of the world on a classroom wall; this is the epitome of “place.” The continents are outlined, filled with a busy patchwork of boundaries and colors showing the nation states, and then dotted with cities and maybe the roads connecting them. Surrounding this is a large, featureless expanse of blue ocean. It takes up 70% of the map, but only 3% has ever been explored. We used to think that this ocean domain was just a blank abyss: dark, still, stygian, cold, and lifeless.
Recently, we have come to realize that the ocean is not a featureless void but instead is filled with structure: there are actually rivers in the ocean. Created from thermoclines, density gradients, and salinity frontiers, these deep ocean currents like the Gulf Stream play a dominant role in determining the Earth’s climate and weather. It turns out that “flow” is of equal importance to “place”.
This “flow vs place” duality is fundamental to quantum mechanics. Expressed in Heisenberg’s Uncertainty Principle, it states that you can either know a particle’s location or its direction of flow, but not both. Beyond the realm of physics, we see the same duality in economics, linguistics and biology. In economics, there are two ways of evaluating a corporate entity. The “flow” approach sees a company as a going concern, summarized in the P&L report. The “place” view sees it as a pile of assets and liabilities, summarized in the balance sheet. These two different views are the bedrock of all financial analysis. Equally, in linguistics, the fundamental division is between nouns (things), and verbs (actions).
In biology, we tend to think of animals and plants as matter. But they are in fact systems, through which matter is continually passing. We think of a tree as a static thing, but it is equally an energy process, pulling in carbon dioxide, water, and sunlight, and producing sugars and oxygen through photosynthesis. Likewise, in animals, the Krebs cycle defines the way that carbohydrates are converted into energy through a complicated shuffling process of enzymes and catalysts. You are both a living object and an energy process, burning food to make energy.
All life-forms can be seen as processes, not things. Vulnerability to cyber risk can be viewed in the same dualistic way. The “place” view is focused on objects and technology components: the devices, the network, the servers, the software, and all the other parts of the IT infrastructure. The mistake that many companies make is the belief that cyber risk belongs “down there”; that it is solely a question of “fixing the kit.” But just as a firewall mediates the flow of data from the outside to the inside, it is important to examine processes—the “flow” view—when building cyber defenses.
There is always a debate in organizations about finding the best balance between resilience and efficiency. Security measures have an overhead cost, both in time and money, and can be seen as an obstruction to business rather than an enabler. Process vulnerabilities normally stem from a misalignment between security procedures and business objectives. The lesson here is, don’t forget the “flow”—processes may need more attention than things.
