Responding to user needs rather than deciding far in advance what should be
built
Data sizes massively increased
DDoS are frequent and huge
Doing the change
Security people embedded into sprint teams (PDUs)
‘Shadow IT’ - go to third party SaaS and devices because they help get the
work done in a way which isn’t possible with tools provided by (and managed
by) the organisation
« Seems to have a different idea about what devops is - focused on
delivering tools »
Risk-based approach
Rather than a binary yes/no, understand the risks: mitigate them or decide
to accept them
Aggregating information about incidents, threats and claims alongside
risks: information aggregated allows an understanding of risk appetite
Security capability drivers
Need to be “Breach-ready”
“Leading from the top” in terms of education around e.g. spearphishing:
ensuring that the top people in the organisation have good understanding
Use big data analytics to whittle down the huge numbers of potential
incidents to ~100 which can be investigated as likely incidents
Challenges
Agile vs Security tension: need to have the same deadlines, be on the same
team. Discussion is around managing risk not blocking.
driven by demand and risk
Remove accreditation step: risk assessment needs to be done throughout
Risk in the supply chain: other orgs risks aren’t in your control
People are responsible but not accountable
People: The Strongest Link - Emma W, NCSC
Diverse skills needed to address the really hard problems
We haven’t put nearly enough research into how people function wrt security
focus has been on trying to ‘fix the user’
Punishing users for falling for phishing attempts doesn’t make sense
some are really good!
wastes time and money
hurts users
doesn’t change anything!!
We ask users to decide whether they trust emails - how are they supposed to
do that
No evidence that regular password changes help to make accounts more secure
We understand tech more than we understand people, so we make the tech then
ask people to come to it
“Security must work for people, because if security doesn’t work for people,
it doesn’t work”
Policies are often a stick to beat people with when they do things wrong -
not a tool to help them to do things right
“People are the only link”
Video
When your employees bend the rules, they’re trying to tell you something