1.
Achieving Durable Security :
Being Honest About What You Can Really Do.
Thomas Whipp MSc MEng CISSP CPP CBCI
Head of Risk
Oval Ltd

2.
Presentation Overview
What are the
Thinking
Where are the
Where are you
real costs of
differently
risks?
starting from?
your strategy?
about security

3.
Where are you starting from?

4.
Your Information?
Printers
Mobile Excel
Phones SQL
Emails Memory Sticks
Scanned Images

5.
Your Business
Capital
Will it really
Who’s Value for
Incident
Politics
Costs
Vs. Displacement
Prevention
Detection
Will it work?
be spent?
budget? Response
Money?
Revenue

6.
Where are the risks?

7.
Who is out there?
Technical Industrial
Script
State Social
Hacktavists
Criminals
Attacks Sponsored
Espionage
Kiddies Engineering

8.
Thinking Differently About
Security

9.
Rational Choice Theory
Evaluation of risk
and return ? How much will I get
? How likely am I to be caught
Uses
? How large is the punishment
A good model for planned offences
Typically acquisitive in nature
Largely fails to explain expressive offences

10.
Routine activity theory
Can be used to
Lack of a
explain
Motivated
capable
offender
everyday type guardian
crimes

11.
Situational Prevention
Ronald v Clarke
Examples:
Crimenot
Near not Increasethe
Reduce the
5 Main
Remove
Reduce
Key Concerns
How not why
Event driven
distant cause
criminality provocations
excuses
mechanisms
rewards
effort
risk

12.
Defensible Space
Oscar Newman
Thinking point: Territoriality Natural
Key Points (key behaviour to surveillance
Image Milieu
Is it worth allowing encourage) personalisation at the desktop?
some

13.
Displacement
A key criteria used to assess physical security initiatives
Putting in a control
May not reduce offending
May simply move it elsewhere

14.
Disinhibition
Key challenge
Leads to
Strong
sense of
for InfoSec
anonymity
significant Lack of a sense
of consequence
awareness but
changes in
also situational
Disassociation
behaviour
from the ‘real
controls
world’

15.
What are the real costs of your
strategy?

16.
Covering your bases...
Spreading the costs
Prevention
Response
Residual
Detection

17.
Choosing a Strategy...
What are the options?
Process Any option canProduct
deliver an
effective control
if implemented
properly
Service Architecture

18.
Risks to Strategy...

19.
Choosing a Strategy...
Controls and their true costs
100%
90%
80%
70%
60% Political
Effort
50% Revenue
Capital
40%
30%
20%
10%
0%
Process Product Service Architecture

20.
Tom Whipp MSc MEng CISSP CPP CBCI
Head of Risk, Oval Ltd
Tel: 01924 433081
Mbl: 07500 796391
Email: tom.whipp@theovalgroup.com