On ‘paranoia’ – revisiting “Paid to be paraoid”

My fellow CISSP and author Walter Jon  Williams observed that

Paranoia is not a part of any mindset. It is an illness.

Ah, Walter the literalist!

Yes I agree with what you say but look at it this way

"We're paid to be paranoid" doesn't mean we're ill.
It's a job.

Now if your job is an obsession, one you take home with you and it interferes with your family life, that you can't let go, then its an illness whatever it is.

"We're paid to be paranoid"

Its a job. You don't pay us Information Security Professionals to be pollyannas, to have a relaxed attitude.

Many of us come from a military or law enforcement background, some having served at the sharp edge of confrontations. The sharp edge isn't always the "mud and guns", sometimes its watching a screen or sifting
through intelligence reports or forensics or after action reports or ...

But if you don't have (a) a suspicious mind and (b) 20-20 peripheral vision about threats and contingencies and (c) a complete lack of silo-ization, then you can't be doing a good job in those roles.

Perhaps there are "pen testers" who know everything about breaking in to a network. Ranum and others have written on why such people are not really "security professionals": part of that is their silo mind-set.
We see similar rants about "jumped-up system administrators".

Many of us here are engineers or have an engineering background or education. Engineers, I've found, often operate on the expectation that things *will* go wrong, stuff *will* break, it *won't* perform to manufacturers specs. Not all of that is experience, a good part is education since they are tight how to build indefinitely reliable stuff
out of unreliable parts - given the budget and opportunity. And if Engineers are sceptical about anything, its Budget.

So when it comes down to a quick description of this "suspicious" mindset, one that is not confined to a narrow silo but covers all the domains of the CBK and possibly more (perhaps you too read Risks Digest and GrandPaRob's book reviews, one that would qualify you for various TLA organizations of which we choose to discuss only in unfavourable terms, _what_ word or phrase are you going to use?

I agree, Walt, the definition of 'PPD' in DSM-IV is unpleasant and not one that I would like to be applied to me:

Paranoid Personality Disorder
-----------------------------
A pervasive distrust and suspiciousness of others such that their
motives are interpreted as malevolent, beginning by early adult-
hood and present in a variety of contexts, as indicated by four (or
more) of the following:

1. Suspects, *without sufficient basis*, that others are exploiting, harming, or deceiving him or her.
2. Is preoccupied with *unjustified doubts* about the loyalty or trustworthiness of friends or associates.
3. Is reluctant to confide in others because of *unwarranted* fear that the information will be used maliciously against him or her.
4. Reads hidden demeaning or threatening meanings into benign remarks or events.
5. *persistently bears grudges* (i.e., is unforgiving of insults, injuries, or slights).
6.  Perceives attacks on his or her character or reputation that are not apparent to others and is quick to react angrily or to counter-attack.
7. Has recurrent suspicions, *without justification*, regarding fidelity of spouse or sexual partner

My Emphasis.
In our profession we have evidence from the past that hackers and extortionists do use information against companies, so our fears are not unwarranted.  We do have justifications for our suspicions, we only need to inspect our logs!  We do have reasons to suspect that our colleagues are, intentionally or inadvertently, leaking information that can be used by adversaries.