Is being paranoid a required 'quality' for Sys/Net administrators?

Paranoia is a dysfunctional personality trait where an individual is suspicious or untrusting without reason. Acting without reason is the antithesis of a good SA.

A system administrator needs to deeply understand the systems they support and be able to quickly analyze problems against business requirements, assess risks, and prescribe action to mitigate problems/risks/etc. An SA also needs to understand the systems enough to quickly develop theories to guide the problem troubleshooting process, but also needs to make decisions based upon facts gathered.

Sometimes those duties makes one appear paranoid on the surface.


You're only paranoid until it HAPPENS... after that you were just "well prepared". ;-)


Critical thinking is a required quality for a good SA. Obviously the clinical definition of paranoia is not what the OP was asking, but even the common definition is not "required".

To the unskilled eye, there may be little difference between a paranoid SA and one who thinks critically about issues like security.

Example: I block outbound SSH because I understand what you can do with SSH tunneling. I know of SAs who block it because "it's a security risk", without knowing what the specifics of that risk are. Am I a better SA for understanding the risk? Perhaps, but at the end of the day both of us took the same action.

Part of the art of being a SA is to know when something that you've been told requires more investigation before you act and when the information is trustworthy enough to act upon immediately.


I believe that pragmatic paranoia is a healthy trait in a sysadmin. Thinking about bad things that might happen and how to avoid them can be extremely useful-- thinking about security and other potential problems makes a system more robust.

The trick is being able to assign weights and probabilities to possible outcomes. You have to be able to estimate the probability of a problem, the severity of the outcome if it occurs, and the cost of avoiding it, and then make pragmatic decisions based on those incomes. Being reasonably paranoid about the company's core data is smart. Being unreasonably paranoid about someone getting to the company's list of corporate holidays seems unhealthy.