Prioritizing use cases – Design Monday

Roberto Giolito has the distinction of winning Car of the Year and Ugliest Car. Both from Top Gear. Both in the same year. Both for the same car. That would be the Fiat Multipla.

To call the Fiat Multipla ugly is to miss the point. It certainly is no looker. The length is shorter than a typical car. The height? Taller. The resulting car looks squat and boxy. But as they say, beauty is on the inside. In fact, the New York Museum of Modern Art (MOMA) showcased the interior. The dash is as highly usable as it is highly unconventional. It seats six comfortably. The large windows create a feeling of space. Small but spacious and maneuverable. The point of this car is to completely satisfy one use case: living the European life while driving the crowded European streets.

When we are designing security capabilities, we start with the use cases. No, that’s too many use cases. Put one back. Still too many, put another one back. There. Good. We start with a few specific use cases and then get to work. Our goal is to fully satisfy these use cases given our limited resources. We will have to make trade-offs. That’s the nature of prioritizing. And when we do? Think of Roberto Giolito who let his design be ugly where it didn’t matter, in order for the design to be Car of the Year where it did matter. Ruthlessly prioritize. Dare to be ugly.

---

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

IT security leaders envision future security capabilities. Capabilities like Identity and Access Management or Threat and Vulnerability Management. Capabilities which enable the organization while disabling the attackers, built upon processes and technology. But there’s a problem. The technologies change. The threats change. Putting aside those change, we have to acknowledge that people aren’t adept at predicting the future. How do we design for the unknown while embracing our shortcomings?

By taking a page from Joe Colombo’s book. Colombo designed a series of futuristic rooms and furniture. The main goal of his design was variability. Each piece was versatile and modular. The overall room was reconfigurable and adaptable. “My design experiences try to create an evolutionary link between current reality and future,” is how Colombo described it. Evolution favors flexibility. As it is in biology, so too in technology.

When deciding between two options, choose the one with the greater variability. This increases the possibilities for handling future threats or technologies. We won’t always get it right. Take just technology. One of Colombo’s pieces couldn’t be produced until the plastics industry caught up. It took nearly 50 years, with the 4801 Armchair finally reaching production in 2011. That said, it’s better to have an unused possibility than have a need that the design can’t meet. To future-proof a security capability, design for versatility.

---

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

Security leaders have a bold vision. Leaders have a grand strategy. Leaders excite and engage people to get things done. Along the way, leaders make decisions.

This blog series is about making better decisions. IT security is a new discipline. But creativity and ingenuity are as old as humanity. Week by week, we’ll look to artisans, to architects, and to designers. We’ll uncover principles we can apply to lead and to design security capabilities.

Latest Design Article

Pilot with chaos. Cyber security is complex. The proverbial butterfly flapping its wings in Brazil producing tornado in the United States. Thankfully, we have chaos theory and security chaos engineering.

– Read the latest design article –

Cyber Security Design Principles:

• Set the vision
  • Frame the initiative: reinforce values
  • Empathy is the heartbeat
  • Listening to users is the start not the end
  • Let go of the past to invent the future
  • Showcase the vision
  • Contrast the status quo with the new vision
  • Tell a story with the project name
• Protect the organization
  • Start with empathy: empathy is the heartbeat
  • Explore complexity: premature simplification is bad security
  • Scale with a philosophy and methodology
  • Reinforce the organization’s values
  • Be provocative and build on strengths
  • Identify friction with better metrics and data visualizations
  • Follow signs of friction to find security champions
  • Asset valuation: remember the chairs
  • Design for change and stability
• Define the security capability
  • Develop team values to make decisions
  • Prioritize: dare to be ugly
  • Define what we do by what we don’t do
  • Balance familiarity with novelty
  • Apply design thinking
  • Make security an inside job
  • Build Roombas not Rosies
  • Focus on the context and surroundings
  • Change the game
  • Designate security advocates
• Develop the technology architecture
  • Future-proofing: choose versatility
  • Re-use: nothing is right everywhere
  • Architecture principles: be principled
  • Play with the spaces in between
  • Mimic, don’t copy or steal
  • Be better, be different
  • Use the power of architectural patterns
• Determine the security controls
  • Frameworks fade but security is eternal
  • Take controls from useless to un-useless to useful
  • Don’t listen to all the music
  • Find your own way without brainstorming or crowdsourcing
  • Be ahead of the curve and ahead of the criminals
  • Balance depth with economy of mechanism
  • Shape the conversation with careful choices
  • Start with minimum viable security
  • Add details to make end-users happy: add some nice rims
  • Identify improvements as security matures
  • Good security has the aesthetics of a good coffee pot 
• Plan the implementation and transition
  • Take it one metaphor at a time
  • Hand out Ray-Bans not safety goggles
  • Plan to wear in, not wear out
  • Plan to get lucky
  • Execute a series of playful pilots to refine the plan
  • Pilot with chaos
  • Start strong, start with style, start like movies
  • Direct security projects like Hollywood’s Golden Age
  • Partner with IT and design for disassembly

 

Finally: Here are some of my folksy sayings on cybersecurity leadership and design.

---

https://jwgoerlich.com/cyber-security-design-studies-papers-books-and-resources/

The Design of Everyday Things, By Don Norman (W)

The Art of Innovation: Lessons in Creativity From IDEO, America’s Leading Design Firm, (2001) By Tom Kelley and Jonathan Littma (W)

Design and Marketing of New Products, Prentice-Hall, Second Edition 1993, By Urban, G. L. And J. R. Hauser

Designing for Growth: A Design Thinking Tool Kit for Managers, By Jeanne Liedtka, Tim Ogilvie, Columbia University Press

Designing for The Digital Age: How to Create Human-Centered Products and Services, By Kim Goodwin

The Principles of Product Development Flow: Second Generation Lean Product Development, By Donald G. Reinertsen

User Experience Revolution, By Paul Boag

User Friendly: How the Hidden Rules of Design Are Changing the Way We Live, Work, and Play, By Cliff Kuang and Robert Fabricant (W)

Services

Service Innovation: How to Go from Customer Needs to Breakthrough Services, By Lance A. Bettencourt

This Is Service Design Thinking: Basics-Tools-Cases, Kindle Edition, By Mark Stickdorn

The Handbook of Service Innovation, By Renu Agarwal, Willem Selen, Göran Roos, and Roy Green

Research

Design Research: Methods and Perspectives, By Brenda Laurel

Research Methods for Product Design, By Alex Milton And Paul Rodgers

Well-Designed: How to Use Empathy to Create Products People Love, By Jon Kolko

Prototyping

Paper Prototyping: The Fast and Easy Way to Design And Refine User Interfaces, By Carolyn Snyder

Product Design and Development, By Karl Ulrich, Steven Eppinger, and Maria C. Yang

Roadmap

Product Roadmaps Relaunched: How to Set Direction While Embracing Uncertainty, By C. Todd Lombardo, Bruce Mccarthy, Evan Ryan, Michael Connors (W)

Environmental Sustainability

Design for The Environment: Creating Eco-Efficient Products and Processes, By Joseph Fiksel, Mcgraw Hill, New York, 1996

Integrating Environment and Technology: Design for Environment, In The Greening of Industrial Ecosystems, By B.R Allenby, National Academy Press, Washington, DC, 1994