The cybersecurity dilemma game: moving cybersecurity beyond solutionism

Abstract

Faced with ubiquitous cyber-attacks, the field of cybersecurity is scrambling to develop both technical solutions as indicated by incessant streams of updates, and social solutions as indicated by a surge of awareness campaigns. However, it is increasingly clear that the dominating underlying narrative of solutionism–the conviction that relatively neat technical or social fixes can be found to well-defined problems–is strangely out of sync with a substantial part of everyday practices of securing IT. Cybersecurity work often entails dilemmas, compromises, and half-baked solutions, which are carried out and maintained with the intention of caring for cybersecurity, but without the expectation of ever reaching a fix or a proper solution. In this article, we explore this practical, dilemma-oriented style of thinking about cybersecurity as opposed to the prevailing solutionism. First, we present emerging literature in the field of Science & Technology Studies that underpins dilemma thinking. Second, we draw on an ethnographic study of small and medium-sized Danish companies to describe how solutionism and dilemma thinking are manifested in practice. Third, we present our efforts to develop a cybersecurity dilemma game that invites otherwise solution-oriented cybersecurity experts into dilemma thinking. Fourth, we present our game playing experiences to reflect on the implications of dilemma thinking. Finally, we summarize the key differences between solutionism and dilemma thinking, and we argue that the field of cybersecurity must experiment with tools and communication strategies like the dilemma game to take non-solutionist narratives and practices into account.