Reinforce Values – Design Monday

Bas van Abel found his personal values in conflict with his technology use. Namely, his phone. He set out to bring these two into alignment and, in doing so, designed a phone and launched a company in 2013.

The Fairphone aims to be as socially conscientious as possible throughout the supply chain and throughout the lifecycle. Fair mining of raw materials. Fair manufacturing conditions. Fair trade. Also, dear to the hacker ethic? Repairable and modifiable. Build a fairer phone, build a fairer world, that was the design inspiration. You can listen to Bas van Abel on the TED stage: Changing the Way Products Are Made.

People have strong personal values. Companies have corporate values. Hopefully, these values are in alignment. Ideally, people and companies follow their values. If they don’t, well, then values aren’t much of a design consideration. But when we have stakeholders with strong values or a value-driven corporate culture, adoption of our security controls goes much faster and much farther when the security design reflects those same values. Before you think IT security can’t reflect values, remember people thought the same about phones before Fairphone.

It will take work to frame the initiative in terms of values. For example, imagine our initiative is a Zero Trust Architecture and our corporate values include an open culture and a culture of trust. At first glance, the security and the value are at odds. But hold on. What if we position ZTA to increase the openness where possible, while reducing access only where risky? Good. What if we use ZTA as a technology to codify a culture of trust? Better. This example is one initiative but the idea scales. We can design a full security program, say with NIST controls, tied to strongly held corporate values.

If it can be done with a smartphone, it can be done with a security capability. Reinforce organizational values to gain support, speed implementation, and further adoption.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

Roberto Giolito has the distinction of winning Car of the Year and Ugliest Car. Both from Top Gear. Both in the same year. Both for the same car. That would be the Fiat Multipla.

To call the Fiat Multipla ugly is to miss the point. It certainly is no looker. The length is shorter than a typical car. The height? Taller. The resulting car looks squat and boxy. But as they say, beauty is on the inside. In fact, the New York Museum of Modern Art (MOMA) showcased the interior. The dash is as highly usable as it is highly unconventional. It seats six comfortably. The large windows create a feeling of space. Small but spacious and maneuverable. The point of this car is to completely satisfy one use case: living the European life while driving the crowded European streets.

When we are designing security capabilities, we start with the use cases. No, that’s too many use cases. Put one back. Still too many, put another one back. There. Good. We start with a few specific use cases and then get to work. Our goal is to fully satisfy these use cases given our limited resources. We will have to make trade-offs. That’s the nature of prioritizing. And when we do? Think of Roberto Giolito who let his design be ugly where it didn’t matter, in order for the design to be Car of the Year where it did matter. Ruthlessly prioritize. Dare to be ugly.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

IT security leaders envision future security capabilities. Capabilities like Identity and Access Management or Threat and Vulnerability Management. Capabilities which enable the organization while disabling the attackers, built upon processes and technology. But there’s a problem. The technologies change. The threats change. Putting aside those change, we have to acknowledge that people aren’t adept at predicting the future. How do we design for the unknown while embracing our shortcomings?

By taking a page from Joe Colombo’s book. Colombo designed a series of futuristic rooms and furniture. The main goal of his design was variability. Each piece was versatile and modular. The overall room was reconfigurable and adaptable. “My design experiences try to create an evolutionary link between current reality and future,” is how Colombo described it. Evolution favors flexibility. As it is in biology, so too in technology.

When deciding between two options, choose the one with the greater variability. This increases the possibilities for handling future threats or technologies. We won’t always get it right. Take just technology. One of Colombo’s pieces couldn’t be produced until the plastics industry caught up. It took nearly 50 years, with the 4801 Armchair finally reaching production in 2011. That said, it’s better to have an unused possibility than have a need that the design can’t meet. To future-proof a security capability, design for versatility.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.