1. Deming Metaphor: Need Scientific Approach to Transform Cybersecurity through Statistical Quality Control and Process Improvement
Deming: Scientific approach transformed manufacturing industry through statistical quality control and process improvement
Cybersecurity: endless arms race, criminalization/terrorism, counter-productive economic forces, no silver bullets, no “path for improvement”
Transforming theories are disruptive
Transformation requires view from outside
System of profound knowledge to understand the systems that we work in
Process Improvement – power of individual – continuous, incremental improvement – mind-changing training
Measure, metrics, statistics
Security not absolute
Concept, subjective, perception
Accountability issues
No notion of “team”, complex dependencies, afterthought
Metrics ill-understood
Risk/trust analysis, economics, psychology, security-bug vs app-bug, consequences of compromise, Capability Maturity Models don’t call-out “security”
Need research to quantify, measure, model security aspects, to guide process improvement and to rationalize policy decisions