Frameworks and Relationships

Alright, alright. This feels a bit strange. But I’m collecting my folksy sayings on cybersecurity leadership and design in one place. I’ll update this over time.

Good Security

• Good security is usable security.
• Good security gets out of the way of users while getting in the way of adversaries.
  • Good security frustrates attackers not users.
• Good security first delivers a business outcome and then, as a result, increases security.
• Good security supports changing maturity.
• Good security projects leave people hungry to play again

Cloud Security

• Ownership is not a security control.
• Security is not what we control, it is what they do.

Defense and Offense

• When work looks like work, work gets done.
• Risk isn’t the language of the business. Story is.
• Security happens where mankind meets machine.
• The more constraints placed on users, the more creative they become.
• All a better mousetrap does is breed better mice.

Media Mentions

• Four ways CISOs can move enterprise security into the new normal (September 2020)
• A pre-mortem on Zero Trust (May 2023)
• Investments in cybersecurity initiatives (August 2023)

Always remember friends: The Cyber War will not be won with platitudes.

— Wolf

In writing the book Rethinking Sitting, Peter Opsvik manages to do with chairs what we should do with cyber security: study the item in the wider context of how people interact.

Peter Opsvik’s critique is that furniture design isn’t “particularly concerned with the needs of the sitting human body.” Many rituals, he believed, are driven by a need to relieve people and compensate for poor seats; like kneeling to pray or standing to sing. Opsvik considered how the positioning of a chair, say in a kitchen or dining area, can make a person feel more or less connected, more or less important. He also spent considerable time thinking about how sitting changes as children grow into adults.

Design spans time frames: an experience lasting an hour, a stage in life lasting years, a lifetime. It spans contexts: personal, communal, societal.

We struggle with this in cyber security. Take, for example, break glass account. Right then. We setup an account with administrative-level access, write the password on an envelope, and stuff the envelop in a vault. But what happens when most administrators are working remotely? Fair point. Let’s move the password from a physical vault to a password vault, and share the vault with our backup person. But what happens when the vault goes down? How about when the person resigns and leaves for another company? How do we handle the longer lifecycle of this seemingly simple control?

Peter Opsvik’s answer to the lifecycle question is the Tripp Trapp chair. The chair is well-made, long-lasting, and stable. Simply change the seat and footrest, and the chair accommodates the user from infancy to adult. Five sets of adjustments as they mature.

The chair reminds me of the five stage maturity models. Security capabilities move from initial, repeatable, defined, capable, and finally, to optimized. To design a Tripp Trapp security control, think through how to reconfigure the control to support the evolving capability. Ideally, simplify these adjustments down to a small number of items.

What’s the seat and footrest in our break glass example? I suggest the credential storage and credential access. That is, how we set it up, and how the person handling the emergency breaks the glass.

Tripp-Trapp-Tresko is Norwegian for Tic-Tac-Toe. In the kids game, like chairs and like security, you succeed by thinking ahead. “The best sitting position,” Opsvik once said, “is always the next position.” Start with minimum viable security. Plan for future stages early, and identify the adjustments we can make. Good security controls support an evolving capability maturity.

.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

Cyber security can be thought of as a game. Offense and defense. A set of motions and movements to score points, or to prevent the other team from scoring. Red team and blue team. A series of tactics and techniques to break in, or to detect and prevent such action. This thought is a good starting point. But we shouldn’t simply work on being better at the game. We need to change it.

Take basketball. When basketball debuted at the Berlin Summer Olympics in 1936, the game looked much the same as it does today. Sure, there have been subsequent rule changes. But the ball and hoop, well, those are classic.

Except.

During the first fifteen years of basketball, no one thought beyond the basket. Peach basket, to be precise. James Naismith famously nailed a peach basket to a gymnasium wall and thus invented the game. But it was the whole basket. After points were scored, a ladder would be used to fetch the ball. Sometimes, they used a stick to push the ball out. For fifteen years.

Why?

One reason is it’s hard to see beyond things. Functional fixedness. Another reason? We’re hardwired to add rather than subtract. Given the choice between adding a fetching stick and removing the bottom of the basket, we almost always choose the stick.

This human tendency has been studied. (See: People systematically overlook changes). There’s even book on the topic, Subtract: The Untapped Science of Less. The Subtract book looks at it from practically every domain, science to business to medicine and more. Except cyber security. Perhaps we can make it into a future edition.

Imagine people using IT in the organization. Imagine that’s the game we’re seeking to win. Get a sense of the players and the ball using business impact analysis. Get a sense of the movement and plays using journey mapping. Now imagine ways to secure this.

Your instinct will be to add. Pause. Look around for the peach baskets which can be replaced with hoops. Find something to subtract that improves the security.

Then change the game.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

“Simple cars need complex wheels.”

So said automotive designer Lowie Vermeersch about the Pininfarina Nido. When you make something so incredibly simple, a bit extra makes the entire thing pop.

The equivalent of nice rims in a security capability is that one thing we do that goes just a little bit further to make the end-user happy. It’s not something we have to do. We’re going to need wheels anyway. It’s a little extra.

It’s not something that adds much to the cost of the project. A nice set of rims runs around $1,000 with the average price of a car being $40,000. But its something the end-user notices and appreciates far above the price tag.

The path for designing a security capability goes from complexity to simplicity, taking those steps with empathy and understanding. As we follow that path, keep an eye open. Find opportunities to spend a fraction of the budget (say 1/40th?) on one detail that pleases people.

Simple security still needs chrome.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.