Finding The Hidden InfoSec Story

Laboratory Monkeys – “This Is How Things Are Done Here”


Photo Credit: pics721 via Compfight cc

Once, a scientist conducted an experiment with monkeys in order to demonstrate his theory about the formation of a group’s culture. The experiment was conducted as follows:

Five monkeys were placed in a closed room. In the centre was a staircase and on top of it, a bunch of bananas. When a monkey went up to get the bananas, a jet of cold water was triggered upon the other monkeys. The monkeys hated the cold-water bath.

After some time, when a monkey started to climb the stairs, the other monkeys held him and drubbed him until he gave up. Sometime later, no monkey climbed the stairs, even though all of them wanted to get the bananas.

So, the scientist replaced one of the monkeys with a fresh one, which never belonged to that group, or had been subjected to the experiment. Very quickly he tried to pick the bananas but on his first contact with the ladder he was knocked down and beaten up hard. After several beatings, the new monkey did not even look at the stairs.

Another monkey from the original group was replaced and, guess what… He was beaten even harder, especially by the first replacement monkey.

One by one they were all replaced, and amazingly, the same behaviour occurred. The group of five monkeys who never knew there was a water jet in the room, kept hitting anyone who tried to get the bananas. At that point the scientist had long ceased to use the water jet, but even so, there were no further attempts.

The scientist’s conclusion was obvious, a norm was established. A group member was not allowed to touch the bananas and everyone respected the norm, even without knowing exactly in what context that standard was created and what problem it was trying to solve.

In everyday life we are subjected to several similar situations. We are inserted into unknown groups, we are confronted with rules and procedures whose purpose we do not understand and we lose our capacity to aspire “bananas”.

This situation annoys us, because everybody has experienced something similar, or seen something similar up close. Bringing the scenario to the security area it means we focus our effort on means and not on the goals. Who never heard something like: “I implemented the standards, so how did they hack me”?

It gets more awkward because in most cases, the standards are born to ensure safety in a certain context for which they were designed; whoever designed the standards had a very clear problem to solve and the steps necessary to solve that problem gave form to the norm. Unfortunately, If you apply it to the wrong problem, it is nothing more than bureaucracy.

And by the way, that’s how our story ends, when the monkeys were asked (yes, yes, yes… It’s a story… they were asked… and also replied… check it out) about the reason for their behaviour, and they replied: “We do not know, but this is how things are done around here”.

The moral of the story is that we should focus our efforts on ultimate goal: “keep the environment safe, by choosing very, and I mean very carefully, the best practices that really address the environment safety and also, we should always keep our minds open, so we might realise when our solutions are no longer effective, because the problem has evolved”. Norms, standards and best practices are great tools in the right open-minded hands, but can be very crippling in the wrong hands, so use them wisely.

Author: Rafael Lachi

Share This Post On