On the necessary re-design of security controls. To provide guiding rails to keep only those that sway too far out, instead of slamming everyone into compliance with too-tight rails.

1. Limits
Not rails
About groups, rules and defectors
Jurgen van der Vlugt
Dialogues House Amsterdam, 6 June 2013

2. Introduction
• Jurgen = Ir.drs. J. van der Vlugt RE CISA CRISC
• Plus the usual disclaimer that this is Work In Progress
• So, questions please

3. Agenda
• Rails
• Rubbish
• Reactions
• Radicals
• Guiding rails
• Risk ‘Management’

4. Rails

5. Rails
People-less Process & Technology

6. Rubbish →

9. (FUD)

14. Reactions to rules

15. Response

16. Range

17. Reaction;
ratio (!) and psycho

19. Radicals
• Extremist-bureaucrats
• Defectors
• ALWAYS
• They belong!
• Keep it fresh!
• So keep them close…?

20. Freedom through guiding rails
De scheef is niet van caouchouc

21. Guiding rails

22. Societal pressures; effective design
• Understand the societal dilemma
• Consider all four societal pressures
• Pay attention to scale
• Foster empathy & community
• Use security systems to scale
• Harmonize institutional pressures
• Ensure fin.penalties ~ detection likelihood
• Choose general, reactive sec.systems
• Reduce power concentrations
• Require transparency

24. Clear requirements

28. Resilience

29. Pt > Dt + Rt
(Pt > 0)
E = Dt + Rt
(Pt = 0) →
Zero-day exploits, or
any unknown vectors
(Note:
• Clusterfucks
• FUQed
Boy scout model!
Guiding rails

32. Conclusion: Risk ‘Management’
• Biases (list)
• Notice the weak signals
• Be creative
• Don’t be a dictator (guiding rails)
• Clear requirements
• Be Prepared!

33. Hope you enjoy(ed) the ride
That was all. Thank you.

35. Dank u

36. Further Reading

37. • Jvdvlugt@maverisk.nl
• LinkedIn http://nl.linkedin.com/in/jurgenvandervlugt/
• Twitter @jvdvlugt
• (G+, Pinterest, Tumblr, etc.etc.)
“I hate quotations” (Ralph Waldo Emerson 1849, quoted by Rem Koolhaas in S, M, L, XL, 1995)
Contact details
Dogma: The problem starts at the secondary level, not with the
originator or the developer of the idea but with the people who are
attracted by it, who cling to it until their last nail breaks, and who
invariably lack the overview, flexibility, imagination, and, most
importantly, sense of humor, to maintain it in the spirit in which it was
hatched. Ideas are made by masters, dogma by disciples, and the
Buddha is always killed on the road. (Tom Robbins, Still Life with
Woodpecker, 1984)