BD&F Information Security

Tactics02 - Traffic Signs

Hans Monderman designed the traffic system in Drachten, in north Holland where there are practically no road markings, traffic signs or lights. He did this because he believed that if humans were trusted to interact with one another, compromises will be made.

His street layout and designs encouraged motorists, cyclists and pedestrians to make individual negotiations at every encounter, always with the notion that everyone just wants to get to their destination safely. It has been a resounding success. In 2006, Drachten reported seven consecutive years of zero fatalities.

The system is radical enough to place a children’s playground in the middle of a road forcing drivers to drive at safe speeds and also other users of the space to consider the presence of vehicles. The idea is to make something safe by making it obviously dangerous.

The influence of this approach can be seen on Kensington High Street where the railings and zebra crossings were removed and pedestrians were encouraged to cross wherever they wished. From 2006 to 2008 accidents were reduced by 44%.

I see similarities in Information Security with respects to regulation and policy. It is easy for InfoSec to quote chapter and verse of policies, standards and laws without engaging with the business members who want to move information from one place to another for profit.

Would less regulation work in Information Security? I believe it will reduce the reliance on the static codes and get InfoSec to engage more with the business. For this to work everyone has to be aware of the dangers within Information Technology.

This awareness is not geared towards less interaction but a more cautious, cooperative approach. Teams wanting to purchase Cloud services, for example, will be willing to ask the security questions of the suppliers or engage their InfoSec team more readily to assess the security of an offering.

Companies will have to build a culture of education for all members, not only focused on policy but how IT works and what are its weaknesses. There should also be fair and consistent penalties when incidents occur.

When end users are empowered to make decisions regarding the exchange of data, a company will have a larger group of people working towards its success, in a unique, secure, digital environment.

Tactics01 - Child Gates

My son is a year old and is starting to walk. We knew we had to make some changes as the stairs are quite steep and from previous experience, it is easy for a baby to have a tumble while learning to climb.

There were a few tactics I can employ to avoid such a scary mishap but there were other considerations besides not wanting him to have a fall.

Firstly, we recently moved in and stuff is constantly on the move as we have not yet worked out, what goes where. The older two have a lot of toys that they bring down each day and pack back at night in their rooms upstairs.

Secondly, the baby is almost always supervised and we trust the habits we have of keeping him under close watch. This though will change as he gets better and faster at walking.

Thirdly, I want him to learn to climb the steps in a safely manner and I think the early he is given a chance to try it, the better it is for all the family.

We had two child gates at the last house, one at the top of the steps and the other to the living room where the first two were able to roam without getting into the kitchen and also up the steps. This time the layout is different and the baby has a larger area on the ground floor to practice his walking.

In the end we settled on one gate at the bottom of the steps. This divides the house in two with free roam for baby boy on the ground floor and ease of use for everyone else. Upstairs we make sure whichever room he’s in, the door is kept shut.

So far, so good. As he gains confidence in his walking, he gets a supervised go at the steps but the gate remains closed not only through habit but through the swing lock design that makes it near impossible to stay open.

The choice of a single gate was not the only one. It was the one that presented the safest compromise for all involved. Information security has to make similar choices all the time in situations where different factors have to be considered and it is not necessarily the best touted option that delivers the most desirable result.

This brings me neatly to Information Security. The degree to which you rely on technology to secure data versus human habit and company culture will vary for each situation. The costs you are willing to sustain, you assessment of the attendant risks and the ethos of your business must all be weighed when such a decision is being made.

Laws and policies are useful but they can never cover all the circumstances that each business will throw up. It is up to the individual companies to work out how they want to balance all the factors so as to maintain their competitive advantages in a secure environment.