The document discusses principles of information security and service design. It advocates designing security into systems from the start rather than adding it as an afterthought. Following human and organizational needs and understanding risk appetite are important. Security should be user-friendly, fail safely with separation of duties, and avoid relying solely on obscurity. As technology shrinks, security challenges will also need to adapt rapidly.

1. Copyright © Oy Samlink Ab
Information
security
♥
service design Service Design Drinks
10.2.2015
Jari Pirhonen
@japi999
www.slideshare.net/japijapi

2. Copyright © Oy Samlink Ab
Why do cars have brakes?
10.2.2015@japi999

3. Copyright © Oy Samlink Ab
Because speed is
nothing without control!
10.2.2015@japi999

4. Copyright © Oy Samlink Ab
Why information security?
You want
 enable business, trust, 24/7
10.2.2015@japi999
You must
 compliance, regulation
You fear
 risk management

5. Copyright © Oy Samlink Ab 10.2.2015@japi999

6. Copyright © Oy Samlink Ab 10.2.2015@japi999

7. Copyright © Oy Samlink Ab
Security – tower of Babel?
10.2.2015@japi999
Horizontal innovation
Verticalinnovation

8. Copyright © Oy Samlink Ab
Security = Quality
Security service <> Secure service
Security design <> Secure design
10.2.2015
Information security is too important to be
left just to information security experts!
@japi999

9. Copyright © Oy Samlink Ab
Quality by design
Security by design
Privacy by design
Secure defaults
10.2.2015@japi999

10. Copyright © Oy Samlink Ab
Rule #1
Users are NOT the weakest links
10.2.2015@japi999

11. Copyright © Oy Samlink Ab
Set the bar for security
 Service environment
 Crown jewels, users, adversaries
 Business needs & risk appetite
 Security requirements
 Want, must, fear
 Understood, accepted,
communicated
 Human (irrational) behaviour
10.2.2015@japi999

12. Copyright © Oy Samlink Ab
Security must be baked in
not sprinkled on top
 KISS
 Check the input  garbage in, garbage out
 Secure, Fast, Cheap: Pick any two
 Defense in depth (or the onion principle)
 Fail safely
 Separation of duties
 Four-eyes principle for security critical tasks
 Do not trust blindly
 Open design - no security by obscurity
 User-friendly, intuitive, invisible security
10.2.2015@japi999

13. Copyright © Oy Samlink Ab
Better than secure?
10.2.2015
Secure
@japi999
Resilient Antifragile

14. Copyright © Oy Samlink Ab
What used to fit in a building,
now fits in your pocket,
and what fits in your pocket now,
will fit inside a blood cell in 25 years.
-- Ray Kurzweil
10.2.2015@japi999