Thinking about offendingThinking about controlWhy do people behave differently online?Are we going in the wrong direction sometimes?
evaluation of risk and returnHow much will I getHow likely am I to be caughtHow large is the punishmentUsesA good model for planned offencesTypically acquisitive in natureLargely fails to explain expressive offences
A good model for "drive by" actssuitable targetmotivated offenderlack of a capable guardianCan be used to explain everyday type crimes.
Key ConcernsCrime not criminalityEvent drivenNear not distant causeHow not why5 main mechanismsIncrease the EffortIncrease the risksReduce the rewardsReduce provocationsRemove excusesExamples: CCTVHashing of card datalogon notice stating audit log policy
4 b. thomas whipp presentation
Achieving Durable Security :Being Honest About What You Can Really Do.Thomas Whipp MSc MEng CISSP CPP CBCIHead of RiskOval Ltd
Presentation Overview What are the Thinking Where are the Where are you real costs of differently risks? starting from? your strategy? about security
Rational Choice TheoryEvaluation of risk and return ? How much will I get ? How likely am I to be caught Uses ? How large is the punishment A good model for planned offences Typically acquisitive in nature Largely fails to explain expressive offences
Routine activity theory Can be used to Lack of a explain Motivated capable offender everyday type guardian crimes
Situational Prevention Ronald v Clarke Examples: Crimenot Near not Increasethe Reduce the 5 Main Remove ReduceKey ConcernsHow not whyEvent drivendistant cause criminality provocations excuses mechanisms rewards effort risk
Defensible Space Oscar Newman Thinking point: Territoriality NaturalKey Points (key behaviour to surveillance Image Milieu Is it worth allowing encourage) personalisation at the desktop? some
DisplacementA key criteria used to assess physical security initiatives Putting in a control May not reduce offending May simply move it elsewhere
Disinhibition Key challenge Leads to Strong sense of for InfoSec anonymity significant Lack of a sense of consequence awareness but changes in also situational Disassociation behaviour from the ‘real controls world’