Intro
Full text below. To watch a fun video about this letter, check it out on YouTube!
On Talent Points
As fighter pilot John Boyd once said, "to be or to do."
I have a finite amount of time in my life: do I want to spend it on being someone or being able to do something? The answer for this question is different for every person, and is influenced by their calling.
If I am playing World of Warcraft and switch between protector and healer often, I can be decent at both but never great at either. For greatness is not about talent alone, but talent and practiced skill.
And the hardest content in life, the things that make a difference after I am gone, all require greatness.
Concept
When I play a role playing game, a motivating factor for leveling up is the ability to freely choose where to place a talent point, a currency that represents the unit of time and effort required to obtain it. Do I want more speed? More strength? To improve a specific skill to be better? Many choices! Handle it!
What if I was able to in real life devise a currency for both my time and effort? To make a talent tree for my life? How would my day-to-day life change if I knew that I would get a talent point to make me better at something of my choosing? How would I build myself and would I be built differently than I currently am right now?
The answer depends on if I could see the rest of the talent tree. Without seeing the bigger picture, I would spend my points based on what I need for that day, at the whim of my immediate goals.
So how do I make a talent tree for myself? The answer: a well examined life.
And work, hard work.
Cyber Archetypes
Since I am writing not only about philosophy but hacking philosophy, I will apply this concept to hackers and cyber security operations.
There exists this notion that there are only two talent trees, two paths, for cyber: red and blue. Offense and Defense. I see four distinct talent trees to choose from, however:
- Adversary
- Recovery
- Risk
- Leadership
The Adversary tree is for direct engagement with a threat. Talents in this tree are for clearing the path.
The Recovery tree is for recovering from an engagement with a threat, ensuring that the party survives. Talents in this tree are for staying on the path.
The Risk tree is for identifying dangerous threats, categorizing them, and methods for finding dangerous monster nests (either for hunting them or avoiding them). Talents in this tree are for finding the path.
The Leadership tree is for determining which goals are worthy and will get the party skilled up enough to challenge harder content. Talents in this tree ensure the team is ready for the path. While the other three talent trees can be for “solo play”, the Leadership tree is the only one that requires a party.
Cyber Job Classes
In an RPG, there are always different job classes, or archetypes - tank, healer, damage. And there are always different ways to do each, called job classes.
An example for damage dealers: a rogue versus a hunter. One is up close (the rogue), the other is far away (the hunter). Both are viable, both have strengths and weaknesses. Both accomplish the same goals of the archetype in their unique way: the damage dealer.
An example for cyber, offensive security: operators and pentesters. One operates without telling anyone, the other tells everyone. Both are viable, both have their specific uses. Both accomplish the goals of the archetype: the Adversary.
The stats used for a rogue are not the same as the stats used for a hunter, even though they have similar roles. The training used for an operator is not the same as the training needed for a pentester, even though they may cover similar skills.
Why is this important? Because to be effective, I need to know what archetype I am. I need to know what it is that I bring to the party, how to become better at my role, what stats I need to prioritize , and how best to spend my talent points.
If I put one talent point in each of the four cyber archetype talent trees, guess what happens? I am okay at many things, but not valuable for any. Unfortunately life is not the same as a video game where, there are opportunities to either change our class, or reset our talent points.
So getting it as right as possible on the first time through is important.
My rough sketch ideas for the job classes are as follows:
Adversary: Operators, Pentesters, Threat Hunters
Recovery: SOC, IR, IT (Hybrids)
Risk: Auditors, Framework Writers, Business Analysts
Leadership: Tactical (Team Leads/Managers), Strategic (Manager of Manages/Directors), Organizational (VP/CISO)
My Cyber Talent Build
I know what I am. I am an Adversary archetype that has spent enough points in the Adversary talent tree that spending more produces diminishing returns. So I have started dropping points into Leadership, a supporting tree that does not invalidate the Adversary points I have spent (time) but enhances them. The more that I go back and put more points into the Adversary tree, the less effective I become as a Leader archetype.
Most important though, is that I know the path that lies in front of me and how to build towards it effectively.
Wrap Up
I understand that life is not a video game, and not everything will be as black and white on paper as in reality.
The core message of this letter is thus: the cost of greatness is our time. To spend our time on something that does not take us step closer to greatness takes us one step away from greatness. If we aren’t going forward we are going backwards. That statement at the least, is black and white.
Eventually, we will run out of steps to take and there is no talent reset button.
Do not spend time blindly. Know what direction should be traveled, know what the ultimate destination is, and head out in that direction.
Farewell.