California Academy of Sciences and the Unified Model of Aesthetics – Recap

CyberSecurity design weekly recap for October 26-31.

This week: Renzo Piano and the California Academy of Sciences. There’s a tension when designing a security architecture. The architecture must meet and mirror culture of the organization. The design can’t run contrary to how the organization works. But at the same time, the new controls must facilitate a cultural change towards a more secure way of being. The architecture mirrors while it modifies. Principle: Design for change and stability.

Previously: Paul Hekkert and the Unified Model of Aesthetics. Most Advanced, Yet Acceptable (MAYA) is the name Hekkert has given this principle. How advanced can the design be while still remaining familiar, still being acceptable, still looking like work? The answer will vary from organization to organization due to culture. But the question must remain top of mind for security leaders pushing the envelope. Principle: Balance familiarity with novelty.

One thing more: I was asked this week: “How can companies reduce the human errors that so often lead to security breaches?” Here’s the thing. The number one cause of problems in early flight? Human error. The number one cause of manufacturing accidents? Human error. Number one cause of nuclear power plant problems? Human error. Security problems? Yep, human error. The root cause of all these issues: poor design.

Check out User Friendly: How the Hidden Rules of Design are Changing the Way We Live, Work & Play for more on the root cause of human error in flight, manufacturing, computing.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

In the Take Controls from Useless to Un-Useless to Useful principle, I wrote about the art of Chindōgu. I was reminded of Kenji Kawakami’s work this week. Matty Benedetto has brought design anarchy into modern times, solving modern problems, with his Unnecessary Inventions.

Consider the mask t-shirt (The Coro-Neck):

No doubt, we need more Matty Benedetto in security control design.

The Entprisers Project has an article on hybrid cloud.

What are the key considerations for hybrid cloud security?

As we recently noted, “Hybrid cloud should strengthen your organization’s security posture, not diminish it. But that doesn’t mean improved security is a default setting. While security fears are declining as cloud matures, security remains an ongoing challenge that needs to be managed in any organization.”

CIO Security LockHybrid cloud security is a big topic; it can be hard to know where to focus. What are the hybrid cloud security questions that you should bear down on now? It starts with visibility. “Too often in modern IT, CIOs and other IT leaders have blind spots in their environments, or they focus too narrowly (or even exclusively) on their on-premises infrastructure,” cybersecurity veteran J. Wolfgang Goerlich, who serves as VP of strategic programs at CBI, told us.

Other key issues include asset ownership controls; compliance controls; security tool interactions; communications, and risk assessment.  As your hybrid cloud strategy grows, so should your security planning.

Read more here: https://enterprisersproject.com/hybrid-cloud

Executives run businesses based on risk versus reward, right? To get action, we need to convey the dollars at stake and the likelihood there will be a loss. You’ll often see this as Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO).

The difficulty I run into is that there is not much hard data on the likelihood of an attack and the typical cost. We can guess, but then the figure ends up being skewed and the rationale does not stand up to scrutiny by senior management. I am hopeful that the recent disclosure laws change this by providing solid statistical information.Posted July 22, 2008 by Wolf Goerlich