What Is Security? Lee's Tech Blog

When people talk about security, they usually think of locks first.

Longer passwords.

Stronger encryption.

OTPs.

Passkeys.

YubiKey.

Physical security keys.

All of these matter, of course.

But truly strong security is not a single object.

However strong a lock, if everything depends on it, that lock becomes a single point of failure.

The essence of security lies elsewhere.

A structure in which one failure does not bring everything down.

What Is the Strongest Living Thing?

At first, I thought of viruses.

Viruses are fascinating entities.

Their bodies are small.

They minimize the functions they need.

They use other systems.

They replicate.

They mutate.

They spread to many places.

Eliminating one individual does not eliminate the whole.

From a security perspective, that is an extraordinarily tenacious structure.

It removes the center and distributes itself.

But push the thought further, and something stronger appears.

Air.

Air has no main body.

No center.

Destroying one location does not make all of it disappear.

It is difficult for anyone to own.

Even where it begins and ends is unclear.

If a virus distributes its center,

air makes the very concept of a center indistinct.

This leads me to a thought.

The best security may be air, not a vault.

Not building the thickest walls,

but making even the target of an attack unclear.

Security Is a Structure, Not an Object

Real security works the same way.

One OTP is not security.

One passkey is not security.

One YubiKey is not security.

Strong systems contain overlapping layers.

Authentication,

devices,

permissions,

networks,

logs,

approvals,

recovery,

and physical security.

Each layer prevents a different failure.

A stolen password is not the end.

A seized device is not the end.

A compromised administrator account is not the end.

When one point breaks, another layer must be waiting.

What makes security strong is not the strongest component.

It is a combination of components with different failure modes.

Then There Is Video

Video is a more interesting medium than it seems.

A still image has space.

Video adds time to that space.

If an image has x and y,

video adds t.

The space in which information can reside expands dramatically.

Not only an object itself,

but its position,

order of appearance,

direction of motion,

changes between frames,

timing of transitions,

and relationships with other objects can carry meaning.

Nor must this necessarily be a conventional cipher.

What is simply a beautiful landscape to one person

may convey a specific meaning to another.

Here the concept of a cipher changes.

Where a machine’s cipher hides values,

a human cipher can hide meaning.

Position, Association, and Meaning

Suppose a video contains a mountain.

The mountain itself may have no special meaning.

But what sits to its left,

when it appears,

what precedes it,

and the viewer’s cultural associations can turn it into entirely different information.

In other words,

Object × Position × Relation × Time × Meaning

this combination can become a code.

The decoder may not be a computer program.

The person becomes the decoder.

Culture Can Be a Key Too

An even more interesting issue appears here.

When people in a society have lived in the same environment for a very long time,

they share certain associations.

They know similar symbols,

use similar interfaces,

act at similar speeds,

and have similar expectations in similar situations.

Culture itself can therefore become an interpreter.

Of course, not all Koreans are the same.

There is no such thing as a completely uniform national character.

But behavioral distributions and cultural grammars shared by many people do exist.

One frequently discussed feature of Korean society, for example, is speed.

“Quickly, quickly.”

Disliking waiting,

checking results quickly,

finding what is needed even on complex screens,

and moving swiftly to the next step—these behaviors have accumulated over time.

Such cultural tendencies do not remain merely sociological traits.

They seep into products.

Into interfaces.

Into service structures.

Over a long period,

an interface becomes a compressed expression of a society’s behavior.

Looking Again at Naver

Foreigners encountering Naver for the first time often feel overwhelmed by information.

Koreans who have used it for years, however, read the screen quickly.

They know where to click.

What is an advertisement,

what is a search result,

where maps will be,

where shopping will be,

and which click takes them to the next step.

There is a tremendous amount of information,

but for familiar users, it is a compressed interface.

An important idea emerges here.

Shared behavioral biases eventually solidify in interfaces.

Read those interfaces in reverse,

and you can read some of that society’s behavioral grammar.

Huge services such as Naver accumulate normal behavior from tens of millions of users over many years.

Then, rather than asking only

“Was the correct password entered?”

we also ask:

“Is this behavior normal?”

A new problem appears.

This is a very important concept in practical security.

Behavior Is Authentication Information Too

Accounts and passwords can be stolen.

Attacks can intercept OTPs.

Attacks can hijack sessions.

But perfectly replicating all of a user’s behavior is much harder.

When they connect.

Which device they use.

Their navigation sequence.

What they click first.

How quickly they move.

How much this differs from their usual behavior.

Together, these form a behavioral distribution.

Add not just the individual’s patterns but the normal distribution of the service’s entire user population,

and security moves further away from being a simple lock.

It looks roughly like this.

Cultural baseline

× Individual baseline

× device

× context

× time

This does not mean a statement like “Koreans are impatient” becomes a password.

Culture is not secret.

Anyone can study it.

But behavioral distributions shaped by culture, combined with other signals, can form a powerful layer of anomaly detection.

More precisely:

Culture is not a password; it is a key that lets people share an interpreter.

And

shared culture becomes a key to meaning,

while shared habits become a key to behavior.

Strong Security Does Not End at Preventing Intrusion

The immune system makes this clearer.

Living organisms do not perfectly block every attack.

They detect.

Identify.

Isolate.

Eliminate.

Recover.

And remember.

Detect → identify → isolate → eliminate → recover → remember

Security increasingly resembles this pattern.

It moves from the idea of perfectly preventing intrusion

to surviving even when intrusion occurs.

That is resilience.

The Future of Security Extends to Approval

As AI agents begin performing real work, this becomes more important.

AI reading an email

is different from AI transferring money.

Analyzing a file

is different from deleting a company’s production environment.

Important operations therefore need new boundaries.

AI proposes an operation.

The system assesses its risk.

An action log is recorded.

At the final critical step, a human approves with a passkey or a separate hardware key.

Here, the meaning of a physical key such as a YubiKey also changes.

It is no longer merely a login device,

but potentially the final approval point between a real human and a digital system.

Ultimately, What Is the Best Security?

Perhaps the best security is security people do not recognize as security.

It exists like air.

It has no single center.

It is distributed across layers.

When one place breaks, another remains alive.

It watches user behavior.

Devices.

The environment.

Time.

When necessary, it also checks real-world video and physical actions.

At the most dangerous moment, it returns authority to the human.

Good security is not about building the strongest lock.

It is about ensuring that breaking one lock gets an attacker nothing.

So we return to the opening thought.

The best security is air, not a vault.

You can attack a vault.

With air, even knowing where to attack is difficult.

And truly strong systems

come to resemble air.