You built a security castle and forgot the bridge…now users are climbing your walls

No ratings

Presented at BSidesLondon 2010 by

Soraya Oca

Every year the UK wastes millions on IT projects. There are many reasons for this and many people to point the finger at, but this is NOT the purpose of this session. In this hands-on session we will concentrate on issues we face as “Security consultants” and the part we play when designing successful secure systems. I have no doubt most of my peers at this BSides are brilliant at revising code and exploiting those weaknesses; even better at firing hard and breaking down the systems … Wooo did you see that??? Your system is Cr*p” Mr Client!, but how good are we at observing the business processes and workflows, at sitting down and listening to the user and understand their functions? How much time do you ever spend at understanding the business needs, the data that the system is handling before you propose security controls? This is not going to be a talk but a hands on session where, drawing from real examples, we will design on the spot, a technical secure solution for them. Then we’ll discuss the level of security vs usability and the risk remaining. This session’s target audience is the security professionals who want to “build” secure usable systems; or those who normally “break” but want to better understand their target environments so they can produce more effective recommendation reports.