Go tell the Spartans… 2,500 years from the Battle of Thermopylae

Five lessons for Cyber Security professionals & a debt owed by our democracies to an ancient military nation.

It was 2,500 years today, that a small group of elite and well trained soldiers (hoplite) made military history by slowing down a vastly superior (in numbers) army.

The legend of the 300, has been popularised (and at some point exaggerated) by Hollywood’s movies like “The 300 Spartans” and more recently the 2006 film “300”, starring Gerard Butler.

There are different reportings of the numbers of Greek and Persian soldiers, but the most accurate modern estimates indicate that there were 200–300,000 Persians, against an overall Greek force of up to 4–5,000. However the Greeks were scattered guarding different parts of the passage, and the 300 Spartans were left to face the Persians on a head-on collision course.

The Spartans died. Every single one of them. But they were never there to win. They were there to slow down the Persians and die in the process. They slowed down the Persians for three days. The morning of the third day, a Persian scout reported that they were bathing, and combing their hair, like they were going to a celebration. The Persians were confused by that behaviour, but those who knew the Spartans, knew that they were getting ready for Hades, the world of the dead.

Why did the Spartans fight?

The truth is that the Spartans could have kept away from Thermopylae and keep safe until they came to an understanding with the Persians. The Persian king Xerxes was actually after Athens. Everybody else was collateral damage. During the battle, Xerxes, impressed by the bravery of Leonidas and his men, send an envoy that offered him the chance to become the King of all Greeks.

However isolated Sparta was, they still saw the Persians as a common enemy and despite the feuds between the city states, they identified more with their arch enemy, Athens, than with Persia.

The Athenians were the ones who needed help. The Persian army was on a fast track to Athens. The small Greek armies were no match for the Persians. At some point there was a Greek soldier for almost 1,000 Persians. No amount of bravery would ever turn the table on these numbers.

The passage of Thermopylae (Hot Gates or Gates of Fire) was the most efficient way for the Persians on their way to Athens, but also the one single point of failure of their route. Thermopylae acted like a siphon, where the narrowest passage became a liability to a huge heavily armed army.

The choice of weapons

The Persian army had different divisions, some of them with heavy armour and heavy weapons. In contrast, the Spartans had chosen light armour, lances to stop the initial wave and daggers to fight body-to-body. Today these would be the difference between heavy and light infantry.

The Immortals, were estimated to be up to 10,000 in strength and they had heavy impregnable armour.

The Persians were forced to walk in an unknown terrain without a solid structure while the Spartans formed a phalanx. The phalanx was lines of spearmen with shields that could solidly resist a face on attack. The effect of the phalanx was that when the first Persians were killed in the narrow passage, the consecutive waves had to walk over the dead bodies of their comrades. This would have been demoralising, but the second and third day, the stench of the dead bodies left under the Greek sun (around 40 degrees that time of the year) would make it even harder for the Persians to fight.

Modern estimates suggest that 10 Persians died for every single Greek.

The Objectives

In the end, the Spartans would lose. The numbers were on the Persian side. But the objective of the battle was not to win. It was to delay, demoralise and slow down the ascent to Athens. All these objectives were achieved. The Persians were delayed, and the Athenians evacuated the city and seeked refuge to the islands nearby while they were getting ready for the sea battle of Salamis (Salamina) a month later.

The Persians reached Athens with only a few old people and some priests left. They burned the city to the ground, and achieved the moral history of revenge for the bad outcome of the First Persian War.

The Traitor: Ephialtes

The Spartans lost on the third day (they could have possibly last one or two more days) because a traitor, called Ephialtes, with local knowledge, received gold from the Persians to take them through an unguarded small pass that would allow them to attack the Spartans from behind.

Since that day, the name Ephialtes is the generic word for “nightmare” in the Greek language and nobody names a child with that name any more.

Why do we owe a debt to the Spartans?

A lot can be said about how older civilizations were, and it is easy for us to judge them. The Spartans were a militaristic society. Every man was grown up to be a soldier. They were few, they commanded a big chunk of land, and they needed to control that land and the people in it.

But these circumstances made them proper soldiers. The Athenians and the Thebans and other Greeks were more of what today we call National Guard (men drafted if and when) rather than regular army.

The circumstances of these times made them who they were. And despite the controversial ways of their society, they were the only body suited for the challenge of slowing down the Persian army.

When I was a student in Greece, history classes at school kept repeating the same motif: how brave the Spartans were and how proud we should be of them.

But the real aftermath of that battle is far more reaching. It is safe to say that Democracy today exists because of the determination and sacrifice of a military city-state.

When the Persians burned down Athens they destroyed the city, not its people. Its people got refuge, they were dispersed and when the Persian left, they came back and resumed their lives and their ways. And one of their ways was Democracy. If the Athenians had been killed and enslaved, there would be no Democracy today the way we know it. The subsequent centuries of Athenian (often called Greek) Democracy would not exist and world history would be different.

Our freedom of speech, self determination, human rights etc. are a result of the preservation of a process (democracy) that was in its infancy back then, and would have not developed had it not been for the three hot August days of 480 BC at Thermopylae.

Thermopylae & Cyber Security? Can we learn something from the Spartans?

One of the things that amazes me, is how many people chose to ignore history. Maybe because of the way history was taught at school: battles and names and dates. We are missing out on a great opportunity to make our world and our lives better.

So applying that part of my history to my work in Cyber Security, I can easily identify some lessons for the (cyber) fighters of 2,500 years later:

a. Have a good PLAN and a good TEAM. The Spartans were preparing for war throughout their existence. They were planning for the day that they would be called to make the ultimate sacrifice. But there was a plan in place. Unlike other kingdoms, Sparta had two kings at all times. Yes, you read right. Two (2) Kings ! One of them would go to war when needed while the other was in charge of the state. Not only that, but when they had to send the first troops out, they would take the men who already had at least one son, who would keep the bloodline going.

In cyber security, this would translate to having two managers as part of a CIPR (Cyber Incident Response Plan), where one is running the cyber defence operations, while the other is concerned with Business Continuity.

b. Training. No other army in that time (in Greece or anywhere else) was so organised, well trained and formalised. The men knew what their place in the phalanx was, what their place in the chain of command and what their job was at all times. The system was so good that Alexander The Great took it and improved it. The Romans took it from Alexander, and the linear tactics of the British Army took the phalanx concept to the next level, at the time of muskets and gunpowder.

Today cybersecurity training is regarded as one the two most important ways of keeping your organisation, your data, your clients and your people safe. Investing in training is by far the best way to prepare.

Businesses need to learn from military history and learn from the military itself. The Army is not good at everything: but it is great at some things. These are the things they drill about every single day, again, and again, and again.

Repetition makes the army a well oiled machine. They respond fast and efficiently, not only in war but in any emergency during a crisis. Many organisations ignore the value of a drill, and believe that by just having a CIPR in a drawer … somewhere … they are fully covered.

c. Clear objectives. When your organisation is under a severe cyber attack, your CIPR and your Playbooks should make clear what the business objectives are, short, medium and long term. Sometimes, like in a game of chess, you will need to sacrifice something to gain something of major importance; a high value objective. Objectives can not be clear during a crisis; objectives of normal day-to-day business change when you are under attack.

New objectives need to be set and properly communicated.

d. Choose your weapons right. Having heavy and complicated tools may not always be the ideal way to defend yourself. Sometimes smaller clusters of tools, thinking outside the box and creating diversions (i.e. honeypots). Light weapons (and cyber tools) allow you for more maneuverability.

For example you may have an option of digital forensic tools, and one is consuming many resources where the other is lighter and faster to give you the results you want. On a moment of crisis the faster and less resource hungry tool is a better choice, as time is of essence.

e. Insider threat. Like Ephialtes, one of the major cyber threat vectors is by far that of the “Insider Threat”. The one person who is going to betray you, is going to be the one who knows your secrets and vulnerabilities.

You need to be ready to deal with the aftermath of treason from within.

“A nation can survive its fools and even the ambitious. But it cannot survive treason from within. An enemy at the gates is less formidable, for he is known and he carries his banners openly against the city.

But the traitor moves among those within the gates freely, his sly whispers rustling through all alleys, heard in the very halls of government itself.”

Marcus Tullius Cicero

Studying or working in Cyber Security does not make you so different. History repeats itself; the names, and banners and weapons change; the concepts always remain the same.

I would like to see history be taught properly in schools. Students do not need to recite names and dates. They need to learn lessons.

And in Cyber security, as in Business and Law, lessons from the past offer an invaluable source of information that can help us make the right decisions for our futures.