A shinobi should have three major principles: skillful speech, boldness, and strategy.
—Yoshimori Hyakushu #38
We know many of the jobs that shinobi performed in feudal Japan, such as committing espionage and sabotage, leading raids, gathering information, carrying out assassinations, and—perhaps the most useful of all—defending against enemy shinobi. But to use shinobi for these purposes, lords and commanders first had to do the same thing that executives and managers still do today: recruit and hire staff.
Scattered but large portions of Bansenshūkai and Yoshimori Hyakushu are dedicated to advising lords why they should hire shinobi, how and when to use them, and the qualities that make a successful candidate—and, eventually, an effective shinobi. According to the scrolls, an ideal shinobi should be:1
In addition to those qualities, shinobi sought for leadership positions must be able to prioritize effectively, execute complex tactics successfully, and demonstrate sound judgment under duress.2
The scrolls also flag certain traits that disqualify candidates, including selfishness and stupidity; immorality (for example, using one’s skills for personal gain); and being likely to overindulge in alcohol, lust, or greed.3 Nepotism might have been a problem as well. While one’s chances of becoming a successful shinobi might increase with the early expectations, opportunities, and grooming that came with being born into a shinobi village (most notably Iga and Koka), being born to shinobi parents did not guarantee success. Such children could, in fact, become low-quality candidates who possessed any number of the negative qualities mentioned above.4
Importantly, in that lengthy list of desirable and undesirable attributes, there are no mentions of specific required skills, past experiences, educational credentials, social pedigrees, ranks, or titles—or for that matter, ages or genders. It seems that being a shinobi was merit based, dependent on the individual’s character, values, qualifications, and abilities.
While the scrolls don’t offer any specific guidance on recruiting, interviewing, or assessing candidates, Shōninki does provide advice on how to understand a person’s deeper nature—their knowledge, modes of thought, beliefs, desires, flaws, and character. Though typically used for spying and targeting, these methods could be usefully adapted for interviewing recruits.
For instance, Shōninki recommends visiting the target’s frequent hangouts to collect information from locals who know the target well. The best information comes from places where the target seems comfortable or has relationships with the proprietors or clientele and therefore is more likely to reveal secrets.5
There is also the skill of hito ni kuruma wo kakeru—“to get people carried away by praising them.” This involves asking the target questions and praising their answers; such flattery makes you seem less intelligent and seems to demonstrate awe in the candidate’s abilities. Done convincingly, this technique loosens up your target, boosts their confidence, and makes them enjoy telling you about themselves, which could lead to all manner of valuable intelligence. For instance, once they’re comfortable, you can change conversational topics and see how they react to unexpected inquiries. Do they have their own opinions, or are they simply parroting other people’s wisdom?6
Recruiting allies and sussing out enemies bore the weight of life and death for shinobi. They often had to decide whether to entrust a person with their life or whether that person would let them down during a perilous mission. As a result, shinobi likely internalized these techniques and other rubrics to become expert people readers, able to quickly and unobtrusively size up someone’s capability, knowledge, and character.7
In this chapter, we will look at the common hiring practices of modern organizations and identify opportunities to incorporate the wisdom of the shinobi into recruiting and training talent. Many hiring managers and even the historical shinobi seem to believe that they can assess the suitability of a person after a thorough interview. While this may work some of the time, many candidates never get the opportunity to attend such an interview due to the various signaling steps, proxy prerequisites, and human resource checkboxes that may erroneously screen them out. We explore these hiring processes in terms of why they may not achieve the desired outcome.
The explosive growth of the cybersecurity sector has led to problems recruiting enough people—and the right people—to perform all the necessary work. While part of this stems from the fact that cybersecurity is a relatively new field with a high technical barrier to entry, current candidate assessment methods are also problematic. Too many private-sector companies place too much value on recruiting candidates who check the right résumé boxes or do well on whiteboard puzzles, but cannot perform the job’s day-to-day functions. Candidates, recruiters, and training programs have noted what it takes to get a job and are positioning themselves accordingly, lessening the effectiveness of traditional methods of candidate evaluation. Universities churn out computer science graduates who cannot solve the FizzBuzz problem, designed to test basic programming skills. Candidates provide potential employers with biased or made-up references. Employees pursue meaningless job titles that look good on a résumé but rarely correlate with their work experience or capabilities. Career climbers attain IT or security certifications by cramming for tests (and often forget that information almost immediately); publish shallow, pointless articles for the visibility; and file for patents by adding their names to projects they had almost nothing to do with.
Measures to combat these hiring loopholes, such as take-home tests, are easily bypassed with online help or outright plagiarism. On-the-spot interview whiteboard puzzles, while once novel, are now routine. Candidates come in having practiced for them and may have even gotten the exact exercises from leaks at the company. Even if they weren’t easily compromised, none of these assessments accurately gauge a candidate’s ability to do the work of cybersecurity.
To be fair, candidates have just as much reason to be suspicious of cybersecurity employers. Even if an organization hires an incredible professional worthy of the title “cyber ninja,” there is no guarantee that the employer will use them effectively. While this risk exists in any industry, it’s compounded for cybersecurity companies for numerous reasons, including the obscurity of the highly technical profession, the evolution of technology, leadership’s lack of awareness or exposure to an employee’s more advanced capabilities, and the importance of nondemarcated creativity to success. To perform well and influence organizational security, employees need leadership buy-in and the green light to exercise their skills without fear of punishment or outright sabotage of their abilities.
One of the biggest recruiters, employers, and trainers of cyber professionals is the US military, who can take nearly computer-illiterate high school dropouts and, over the span of 18 months, train them to become capable cyber warfare specialists. Of course, not every recruit makes it through the training, as multiple layers of requirements filter out poor candidates—a practice that aligns closely with those described for shinobi recruits in Bansenshūkai.8
One distinctive tool in military recruiting is the Armed Services Vocational Aptitude Battery test (ASVAB).9 Unlike corporate recruiting, which emphasizes past accomplishments and professional credentials, the ASVAB assesses recruits’ learning potential, aptitude, and general technical ability. The scores are used to assign candidates to occupational specialties in which they are likely to thrive if successfully trained. The ASVAB has been highly effective for the military, but it’s worth noting that certain cyber jobs have reported unexpectedly high rates of training failure and poor field performance, likely due to the jobs’ demanding attributes that the ASVAB does not always test for. In the structured world of the military, it can be difficult to identify or train people who want to approach challenges with creative, fearless, independent, problem solving–based thinking—a skill set closely associated with hackers.
Everyone wants to hire cybersecurity professionals for their organization, but the supply is limited. So how does everyone get their hands on some cybersecurity talent? Organizations should first determine whether they intend to develop raw talent themselves or compete against other organizations for the limited supply of experienced cybersecurity experts. Many of the recommendations below are suited for developing talent but may be suitable for a hybrid approach as well. Many cybersecurity professionals may agree that current hiring practices are broken and it’s time to move past all the proxy signals to try something new. As an alternative, consider the below approaches to hiring and maintaining talent.
You may find and hire a promising candidate who has high aptitude but lacks the necessary technical skill to do the job. In this case, know that you must make an expensive long-term investment in teaching the candidate actual technical skills. Otherwise, their high aptitude will not help you.
These recommendations are presented with the NIST 800-53 standard and NIST 800-16 Cyber Workforce Framework in mind.11 Consider these recommendations when evaluating potential hires who will implement security controls.
In this chapter, we reviewed the qualities that the shinobi believed were necessary to be successful in their tradecraft. In addition, we described some of the back-channel interview methods used by shinobi. We also explored many of the current hiring processes used by modern organizations and why they not are as effective as desired. We listed some novel approaches to identifying suitable candidates. The thought exercise in this chapter is as relevant today as it was for the medieval commanders who needed to hire shinobi to protect themselves from enemy shinobi. Hiring hacker-like people who may not have a good GPA or a solid work history, or who may not wear professional attire, will likely be more effective in countering cybercriminals than hiring the typical person who colors between the lines.
Once you have hired these talented and/or skilled defenders, it is important to establish standards and processes so they can defend your organization in a disciplined manner. Without leadership that sets clear expectations, the defenders may become lax and thus less than worthless. In the next chapter, we will discuss guardhouse behavior.