I was focused on the game. I knew what I needed to win, and I felt like I had it all planned out. I usually always have things planned out and this time I was in the perfect tunnel vision - when the world around you fades away, and the game is all you can see or think about...“Okay so...don’t die,” I said to myself. “Focus on helping your teammates… Oh and keep an eye on the enemy players.”
I then looked down at the in-game map and saw a team mate chasing after another player in enemy territory with no visibility into the enemy area. Earlier in the game they had gotten a good amount of kills and gold (in game currency) from other sources, which made them a very valuable player because they were strong and could be vital in team fights.
The player knew this, and that gave them the confidence to make some risky plays. Hence their obsession with a lone support player in enemy territory with no visibility.
Some of the plays were good, and since they came out of it alive, they seemed to feel that they were unstoppable. So they kept making more and more risky plays. However, instead of each maneuver being just a “risky play”, it became more like a “List of Rookie Mistakes” one after the other.
The risky player’s chase ended with them being overtaken by the enemy players. Classic Rookie Mistake. We all make them. But this match was important to me, and we didn’t have time for more rookie mistakes. So I decided to say what all my teammates were saying but in a much nicer way. Granted, I shared my teammates’ frustration with the player, but I dutifully followed my personal rules and typed out a nice message in chat: “Yea...that was a trap lol. Let’s stay away from that, we really need you to be alive”.
It was to no avail. Unfortunately, their tunnel vision “moment” seemed to last the whole game. I was beyond frustrated at this point. All they needed to do was stop making the rookie mistakes and focus all their energy on whatever would help take the nexus down—because ultimately that was the objective of this match. If they would just listen to the rest of the teammates, then maybe they could actually be a contributing player. They didn’t even have to take all of our advice, just maybe the heart of the advice…
“An ally has been slain!” declared the game’s automated female voiceover, disrupting my thoughts. I looked around and realized that my ADC (another player, whom I was tasked with protecting) had just died. Like the risky player I was frustrated with, the ADC too was very valuable in this match. Now we were down two important players, not just one.
Naturally, my annoyance now shifted to myself. I should have been protecting the ADC. In the midst of being annoyed with myself and dealing with some very angry teammates—whose anger rightfully switched from the “rookie mistakes” player to me—I realized something.
I realized that while the “rookie mistakes” player was lost in their own tunnel vision, I was lost in my own. In those crucial moments before my ADC died, I was focusing my time and energy on their mistakes instead of concentrating on the role I had been assigned: protect the ADC. Thus, the “rookie mistakes” player and I were guilty of the same crime, as I also lost sight of the goal.
The goal wasn’t to play perfectly and have everyone play at the same artificial (even if superior) level. The goal was to focus on taking the nexus down, and in order to do that, we needed team effort.
The best teams are the ones that allot more energy toward their own individual performance rather than micromanaging someone else’s. When they see a bad (or potentially bad) play, they simply offer a helpful perspective and move on, thereby getting right back to focusing on their own tasks at hand.
Even my “Why I Died” list couldn't help me here. I didn’t die. My ADC did. Thus, at this moment the only list that could help me was a “Why I Missed the Goal”, and the first bullet on the list would be “Stop complaining about your teammates and focus on the goal”.
When that “rookie mistakes” player was in their tunnel vision, so was I. Similarly, in cybersecurity, when that end-user is in their tunnel vision, so are we. Many mistakes (especially with social engineering) are human mistakes rooted in human nature, which we all have. The rest of the mistakes are in fact simply lack of knowledge and not lack of intelligence. We might not have a proper understanding of the steps to take, of situational errors, or even how to quickly identify those tunnel vision moments that seem silly in hindsight.
In cybersecurity we so often seem to focus on having zero risk, especially when it comes to human error. Thus, we get so distracted by our emotions and frustrations with other "players" (aka "end-users") that we forget that sometimes we are also a part of the problem. We fail to realize that if we aren't just as vigilant as those we’re frustrated with, we can fall victim to security risks just as easily. Moreover, our errors could be worse since we may have more access to network systems than the “rookie” individuals we are complaining about.
We also seem to not treat technical vulnerabilities the same way we do human vulnerabilities. While they are indeed very different, we don't have to approach them in such vastly different ways. At the end of the day, they are both vulnerabilities. With a technical vulnerability, we expect there to be risk, and instead of complaining about the inevitable risk, we allot a significant amount of time and money into finding a way to mitigate the risk as much as possible. We sometimes do this by fixing or adding a line of code.
When we are focusing on the goal of mitigating risks and spreading security awareness, we have to remember that it is impossible to create a perfectly risk-free cyber world. The most we can do is fix a few steps to incorporate security into people’s daily lives or add a few knowledge points to increase awareness.
The “rookie mistakes” player wasn’t a bad player. They were actually a very strong and capable player. They just were having a moment, like I was, and they needed something or someone to push them out of that.
So, what happened to him? We told him what we needed from him as a team, we emphasized that he was vital, and we gave a game plan to win using his strengths. I also fessed up to my own mistake and said I would do better as well. Then we all focused on our own individual parts needed to win the match. After this mental shift, a remarkable thing happened: we won the game. No, not every game goes like that, but when we are able to come together as a team, most actually do.
Reflecting on lessons like this one from League of Legends is at least partly why I decided to focus the rest of my career on the human factor of cybersecurity—because it’s time we treat each other like we are all human.
Fareedah Shaheed was born in Maryland but spent most of her childhood outside of the United States. She returned to the US in 2013 and attended the Community College of Baltimore County (CCBC), where she majored in Cybersecurity.
In her free time, Fareedah likes to play League of Legends, read psychology and self-help books, and learn more about the securing the human factor of Cybersecurity.
She is a Year Up alumna and is currently a Security Control Analyst at a Financial Firm in Maryland.