Deming Metaphor: Need Scientific Approach to Transform Cybersecurity through Statistical Quality Control and Process Improvement Deming: Scientific approach transformed manufacturing industry through statistical quality control and process improvement Cybersecurity: endless arms race, criminalization/terrorism, counter-productive economic forces, no silver bullets, no “path for improvement” Transforming theories are disruptive Transformation requires view from outside System of profound knowledge to understand the systems that we work in Process Improvement – power of individual – continuous, incremental improvement – mind-changing training Measure, metrics, statistics Security not absolute Concept, subjective, perception Accountability issues No notion of “team”, complex dependencies, afterthought Metrics ill-understood Risk/trust analysis, economics, psychology, security-bug vs app-bug, consequences of compromise, Capability Maturity Models don’t call-out “security” Need research to quantify, measure, model security aspects, to guide process improvement and to rationalize policy decisions