I despise ignorance, and I’m not the only one. Judges despise it in their courtrooms. Ignorance of the law is no excuse, but it is reality. The ignorance clause works well when the law is defined. When it is not defined, however, ignorance takes center stage and gives an encore, sans curtain call.

The more I read on this topic of ignorance, the more I find myself trying to understand how it applies to security — specifically, to many in the information security world and the rationale behind their thought processes. I have found their poor practice to be ignorance, not stupidity.

Not knowing something is different from being ignorant. Or at least I thought it was.

Ignorance and the Security Industry

According to Psychology Today, there are three distinct types of ignorance. By standard definition, the absence of knowledge is ordinary ignorance. The second is higher ignorance. For example, for as much as I know about general information assurance practices, there is still more that I do not know, but I am willing to grab a book or a mentor to learn it. Finally, there is willful ignorance, which occurs when the information (truth) is there, but you’re obtuse in your thinking.

If I may clarify my earlier statement, I do not mind ordinary ignorance, nor do I mind higher ignorance; in fact, I am guilty of both. But things are different when someone is willfully ignorant. I don’t have time for it, but we are surrounded by it.

Let’s remove all the noise around these distractions and focus on what we do as professionals in our industry. For example, some people exhort fallacies claiming intrusion prevention systems are noisy and full of false positives, or that security intelligence tools require a certain time threshold. This actually leads to cognitive bias: You believe something because your only education was biased.

This is rampant with vendors — most of which would call the practice marketing. When a published how-to book is generic until those chapters that give detail on why said product is vital for obtaining the desired outcome, it’s nothing more than 300 pages of marketing material. I know because I have more than one autographed copy of many books of this caliber.

Eliminating Bias

It is this bias that has to be removed when evaluating security products and practices. Think of executives who shoot straight to some report for advice. How many actually know the testing criteria for the report they read? Where was the critical thinking?

We are always searching for something easier for us as professionals to work with. We get lost in tools’ ease of use. What we have really lost is our sense of curiosity. Where are our tinkerers, our hackers, our inquisitive minds wanting to know more?

Now that I have skirted around willful ignorance, let’s look at that problem as defined. To intentionally keep oneself unaware of the facts is bad practice. It is normally associated with bad faith and leads to using unfounded knowledge when making (poor) decisions. Those who are ignorant due to a lack of knowledge but are willing to learn, process data into information and use cognitive reasoning are not ignorant. Sadly, the adverse is also true.

Stopping this process is much easier said than done. As network defenders, for example, how much information do you share with your like-minded business structures, such as financial institutions sharing attack vector information? In its basic form, this is education and training that helps defeat ignorance. Not taking part in these information sharing practices is being willfully ignorant.

Education Is the Answer

What separates those of us with higher ignorance from those who are willfully ignorant? It starts with wanting to know the truth and being trained to understand the truth, just as you were trained not to be scared of the dark when you were younger.

As a security professional, I am paid to know and understand. I have the mental capacity to learn and make informed decisions. Information on everything is out there — find it.

If I do not know something, I will be the first to tell you. Far too often I get asked about items outside my comfort zone or expertise. In response, I find the answer or someone who has the answer, experience and knowledge on the subject. I still may be ignorant, but it’s not by willful choice.