Compliance is fundamentally at odds with innovation and continuous improvement

Compliance tends to constrain operations to narrow sets of approved sequences of tasks as the means to assure the secure attainment of certain business outcomes. But at what cost ?

🧵

Operational practices have an emergent nature to them. They’re affected by people, their expertise, their relationships, their team goals, role perceptions and also member needs as humans and professionals.
In this entangled mess of variables, aspects practice-as-done are

Constantly morphed as a response to economic pressures (deadlines, business demands), workload demands (as people tend to automate or agree patterns to reduce cognitive load of tasks and become more efficient) and understanding of safety and security related barriers.

All of these tend to be fluid and non fixed. In this continuous interaction with the environment and different pressures acting on it, there are numerous opportunities for improvements which have local relevance and emerge out of local needs and interactions of elements. However

In order to do so, and to support innovation and continuous improvement the practices need to have a requisite level of variability so practitioners exercise their Fingerspitzengefühl (fingertip feel) for what works and what doesn’t, within their constraints and pressures

2 different frames or metaphors for #CyberSecurity

Security as a Quality Management issue thus a problem of robustness

Security as a Safety issue thus a problem of resilience

They’re fundamentally different, may even be at odds but how ?

🧵

A Quality Management metaphor leads us down elements of testing, predictability and reliability in that we aim to be effective at dealing with predicted threats which represent a finite configuration of what our industries expect. We aim for “maintaining process integrity inside

Of known design, training and procedural parameters” (Dekker) so I prepare for a number of scenarios, ways I can foresee and threat model for and (not just operationally, but also reqs gathering, testing, training,sdlc and even threat intel) increasing the robustness of my system

All well and good, but from Complexity science we know that “robust constraints tend to fail catastrophically when design conditions are exceeded” @snowded
But this is also a cautionary tale. If you don’t have the capacity to deal with expected adverse conditions,

You have no business thinking or prioritising adaptive capacity because the “knows” can get you down and keep you there.
So until you get to the point where your robustness is sound, this is the metaphor that is most appropriate and which can be argued for economically