Cybersecurity and Theology

The connection between cybersecurity and theology might not seem all that obvious. I might not have thought of it myself, if I weren't teaching the first and studying the second. But, it is there.

I discovered it thinking about social engineering and the ways threat actors try to manipulate their targets in order to make them victims. In short, a social engineer works on a target through a combination of fear, greed, and misplaced trust to abuse that trust and our compliant tendencies. Threat actors try to create fear in order to panic us and make us more reactive and less reflective. Threat actors play on our greed for the same reason, I suppose. They try to abuse our trust by sending emails which look mostly legitimate or by redirecting us to websites which might look real if we don't look at the edges too closely.

User education is one of our basic defensive strategies because users who've been trained (or perhaps authorized and encouraged) to operate with a certain healthy skepticism are an essential part of social engineering resistance. Knowing what things like phishing, pharming, tailgating, and pre-texting are helps people notice when something isn't quite right and understand how to respond.

The biblical writers were realists about human nature. The stories in the Old Testament are often rather messy. Few, if any, of the Old Testament patriarchs or prophets are unblemished, flannel-board heroes. The Apostles and and disciples were not perfect, either. Jesus called those imperfect people to walk with Him and then into ministry in His name. He told them to expect trouble and practice trust in God. For example, He told the Twelve: "See, I send you out as sheep among wolves; so be wise as serpents and innocents as doves." Some translations render that verse "shrewd as serpents," which I think says much the same thing. Scripture encourages us to be careful, not careless. The books we call the Wisdom literature return to this theme time and again. It's appropriate to be careful, cautious, and even skeptical. Due diligence isn't a lack of faith, but a form of stewardship. It's important to let ourselves notice things. Social engineering is a form of manipulation, so as with any other lie, there will be clues something doesn't add up. 

It's also important to remember who we are, so we can resist the temptations to fear and to greed which social engineers offer us. In Paul's second letter to Timothy, he wrote, "For this reason, I remind you to rekindle the gift of God that is within you through the laying on of my hands; for God did not give us a spirit of cowardice, but rather a spirit of power and of love and of self-discipline." That spirit of power, love, and self-control God gives us comes from the knowledge we belong to God. Elsewhere, Paul writes about the Spirit of Adoption. I think the spirit of power, love, and soundness is related to that Spirit of Adoption witnessing with our own spirits that we belong to God. 

We do not have to be afraid of whatever loss the phishing email threatens because no loss can separate us from God's love. God loves us and wants what is best for us. There is no reason to panic because God is always faithful. We do not need to grasp and claw for easy money because God, who feeds the sparrows and clothes the wildflowers, will certainly look after us. Instead, we refuse both fear and greed, and instead rekindle the gifts and the call God places on our lives.