Designing secure organizations. Risk management, Enterprise security management and ArchiMate.

<p><span style=”color: #505050; font-size: 11px; line-height: 19px;”>No one is allowed to enter the building without proper authorization; all incoming e-mail messages are filtered; personal computers that are used to store sensitive data do not have a direct connection to the internet, and therefore cannot be accessed remotely. With these </span><strong style=”color: #505050; font-size: 11px; line-height: 19px;”>enterprise security</strong><span style=”color: #505050; font-size: 11px; line-height: 19px;”> rules, we have ensured that our private information is safe, right? Wrong! </span></p><p>Cyber-attacks are getting increasingly sophisticated, using a combination of digital, physical and social engineering techniques. A typical example is the so-called “road apple attack”. A would-be intruder “accidentally” leaves a USB flash drive – with company logo – in a public spot such as the company car park. An employee picks it up, and chances are that he will not be able to suppress his curiosity and plug it into his PC. Surprise: the drive is infected with malware which, unless proper measures have been taken, will infect the PC and send sensitive information to the intruder.</p><p><img class=”left” src=”http://www.bizzdesign.com/assets/BlogDocuments-2/_resampled/resizedimage600395-Risk-Management.png” width=”600″ height=”395″ alt=”” title=””/></p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p> </p><p>Of course, there are several ways to prevent this from happening. The system administrator may decide to completely disable the use of USB drives, but perhaps this is too restrictive, causing employees to find ways to circumvent this. Or perhaps a policy against the use of unverified storage devices suffices, if people are disciplined enough to comply with it… There is no easy way to determine how much security is enough, and how much is too much. In other words, how do we find the optimal position on the trade-off between security, usability and costs?</p><p>Most of the present-day security and <strong><a title=”risk management, secuirity measures” href=”http://www.bizzdesign.com/consultancy/governance-risk-and-compliance/”>risk management </a></strong>approaches are based on checklists, heuristics and best practices. Security measures are applied in a bottom-up way, often neglecting the social aspects. This may lead to an overkill of preventive security measures, also in cases where cheaper (and less intrusive) curative measures may suffice. On the other hand, less obvious threats or vulnerabilities in the organization may easily be overlooked.</p><p> </p><div class=”captionImage left” style=”width: 424px;”><img class=”left” src=”http://www.bizzdesign.com/assets/BlogDocuments-2/Enterprise-security-management-ArchiMate.png” alt=”Enterprise Secuirity Management” title=”enterprise security management, model-based approach ” width=”424″ height=”458″/><p class=”caption”>enterprise security management, Archimate core</p></div><p><span style=”font-size: 11px; line-height: 19px;”>To avoid this, we advocate a model-based approach to </span><strong style=”font-size: 11px; line-height: 19px;”>enterprise security management</strong><span style=”font-size: 11px; line-height: 19px;”>, in which security aspects are fully integrated in the design chain: from strategy and business model, through enterprise architecture, to the design and implementation of the organization and IT support. For this purpose, risk-related concepts are included in existing architecture and design languages. At the </span><strong style=”font-size: 11px; line-height: 19px;”><a title=”enterprise architecture, Archimate” href=”http://www.bizzdesign.com/consultancy/enterprise-architecture-management/”>enterprise architecture</a></strong><span style=”font-size: 11px; line-height: 19px;”> level, </span><strong style=”font-size: 11px; line-height: 19px;”><a title=”ArchiMate open standard” href=”http://www.bizzdesign.com/consultancy/enterprise-architecture-management/archimate/”>ArchiMate</a></strong><span style=”font-size: 11px; line-height: 19px;”>, as a broadly accepted open standard (with available tool support) that is suitable to describe business and IT aspects in an integrated way, is an obvious choice. Architectures described in </span><strong style=”font-size: 11px; line-height: 19px;”><a title=”ArchiMate goals, principles and requirements” href=”http://www.bizzdesign.com/consultancy/enterprise-architecture-management/archimate/”>ArchiMate</a></strong><span style=”font-size: 11px; line-height: 19px;”> can be linked to goals, principles and requirements, and to detailed design models expressed in languages such as BPMN or UML. The resulting models provide the input for risk and vulnerability analysis, highlighting the areas in the architecture that are most susceptible to attack. In addition, they will guide the design of effective and efficient security measures.</span></p><p>With this approach, <strong><a title=”Bizzdesign the Netherlands Contact” href=”http://www.bizzdesign.com/contact/netherlands/”>BiZZdesign</a></strong> can help you to design a secure organization – without unduly restricting your people in their daily work. </p>

Categories Uncategorized

On the use of the word ‘delivery’

Enterprise architects and consultants often enjoy building specific languages. This is both good and bad. Good jargon allows one to be very specific and concisely articulate observations about a particular specialised field of interest — for instance a domain architecture or a very specific business process, which only few people understand or carry out. Bad …read more

Open Work: first notes

Open Work


image

An initial sketch of ideas around the concept of ‘Open work’, a developing idea for a manifesto for a new way of working that leverages concepts around openness and technology that enables openness to enable us all to work better, together.

Other than this preamble this is a straight dump of notes i’ve been jotting down, just thought i’d get it out there on the blog as a vehicle for making myself think more deeply about what i want to achieve. My plan is to start fleshing these notes out, into principles (hey i’m an architect!) and trace these concepts to some reality. When I first started thinking about these ideas I happened upon david cushman’s great writing (http://fasterfuture.blogspot.co.uk/2012/07/the-10-principles-of-open-business.html) on the area of ‘open business’, so i’m mindful not to re-hash or at worst plagiarise David’s thoughts (you’ll notice some of my headings map to some of david’s principles.

So my plans consist of trying to frame some interesting and hopefully original thinking, whether this ends up as a post on my blog an ebook, or whatever, i’m not really sure, I’ve just got fed up of thinking things through, so thought its about time I should start, er, writing them through.

concepts/principles

-Context
-radical sharing/shariarchy
-discovery
-foster emergence
-Social architecture: (thinking stack/zachman etc)
-connectedness (connectivity and psychological sense by what? shared vision?
-finding
-serendipity
-ego-less
-embrace criticism but by embracing criticism how to avoid paralysis (too many arguments)
-Clear threshold for decision making – stops paralysis
-radical un-secrecy
-Virtual Structures
-Now-ness – relate to the when/tenses of sharing future, past, present
-Presence
– Energy

Current State:

-No opportunity for serendepity
-Closed networks
-Entropy

Trends:

-Privacy as commodity
-Hyper sharing
-High bandwidth communication/consumption

Thoughts:

There is no reason not to share
There is no impediment to sharing

Categories Uncategorized

The Price of Fish

Michael Mainelli and Ian Harris have written a wide-ranging survey of economics, choice theory (game theory, psychology and ethics), systems theory, chaos theory, global warming and evolution. So what’s all that got to do with the price of fish?

One of the themes running through the book is that the price of fish bears no relation to the value of fish, especially if we are concerned about long-term value and the sustainability of fish stocks.

Oscar Wilde famously defined a cynic as one who knows the price of everything and the value of nothing. This definition has also been applied to accountants and economists. Michael and Ian are leaders of the Long Finance initiative, a movement within the City of London that aims to overcome this kind of short-term financial cynicism.

Michael and Ian describe the price of fish as a wicked problem – a problem that lacks easy definition as well as easy answers.  “Sustaining the supply of edible fish is a wicked problem that presents global risks.” (p 301) And yet they suggest that the system might possibly sort itself out. “As fish run out and have to be sustainably fished, the historic underpricing of fish ceases.” (293)

But this is no time for naive optimism, and the system will undoubtedly need some intervention. “When the price is the same as the value, there are opportunities for sustainable financing. So far, price has not equaled value for fish. This is the biggest, wicked decision-making problem of all: knowing how to set a price that equals the value.” (p 295)

In other words, the problem is not just the alarming dwindling of fish stocks but the collective cynicism that not only led to this problem but also amplifies it and resists dealing with it effectively. The key word in the problem statement is the word “set” – even if a few clever people can agree what the right price of fish should be, the real challenge is to set this price into global trading and consumption systems.

Read more »

The Price of Fish

Michael Mainelli and Ian Harris have written a wide-ranging survey of economics, choice theory (game theory, psychology and ethics), systems theory, chaos theory, global warming and evolution. So what’s all that got to do with the price of fish?

One of the themes running through the book is that the price of fish bears no relation to the value of fish, especially if we are concerned about long-term value and the sustainability of fish stocks.

Oscar Wilde famously defined a cynic as one who knows the price of everything and the value of nothing. This definition has also been applied to accountants and economists. Michael and Ian are leaders of the Long Finance initiative, a movement within the City of London that aims to overcome this kind of short-term financial cynicism.

Michael and Ian describe the price of fish as a wicked problem – a problem that lacks easy definition as well as easy answers.  “Sustaining the supply of edible fish is a wicked problem that presents global risks.” (p 301) And yet they suggest that the system might possibly sort itself out. “As fish run out and have to be sustainably fished, the historic underpricing of fish ceases.” (293)

But this is no time for naive optimism, and the system will undoubtedly need some intervention. “When the price is the same as the value, there are opportunities for sustainable financing. So far, price has not equaled value for fish. This is the biggest, wicked decision-making problem of all: knowing how to set a price that equals the value.” (p 295)

In other words, the problem is not just the alarming dwindling of fish stocks but the collective cynicism that not only led to this problem but also amplifies it and resists dealing with it effectively. The key word in the problem statement is the word “set” – even if a few clever people can agree what the right price of fish should be, the real challenge is to set this price into global trading and consumption systems.

Read more »

EA is Strategic Planning

Enterprise Architecture quite simply is all about Strategic Planning. It helps enterprises shape their future structure and dynamics in the face of the changing environment in which they do business. Its purpose is to understand the ends and means that form the strategies needed. How does an enterprise react to events that do and will […]

Link Collection — January 20, 2013

  • Lower Costs and Better Care for Neediest Patients : The New Yorker

    Excellent article on using data to provide an unusual window into healthcare, and how to improve it.

    “Besides looking at assault patterns, he began studying patterns in the way patients flowed into and out of Camden’s hospitals. “I’d just sit there and play with the data for hours,” he says, and the more he played the more he found. For instance, he ran the data on the locations where ambulances picked up patients with fall injuries, and discovered that a single building in central Camden sent more people to the hospital with serious falls—fifty-seven elderly in two years—than any other in the city, resulting in almost three million dollars in health-care bills. “It was just this amazing window into the health-care delivery system,” he says.”

    tags: healthcare datascience newyorker

  • Solving the Wanamaker problem for health care – O’Reilly Radar

    Good article by Tim O’Reilly, et al. Broad coverage of healthcare issues and opportunities with data science.
     
    “How is data science transforming health care? There are many ways in which health care is changing, and needs to change. We’re focusing on one particular issue: the problem Wanamaker described when talking about his advertising. How do you make sure you’re spending money effectively? Is it possible to know what will work in advance?”

    tags: healthcare datascience O’Reilly

  • Why IT Fumbles Analytics – Harvard Business Review

    This is an excellent article. Calls out the different thinking and actions required for analytics success. Despite the title, this is not an IT bashing article.

    “In their quest to extract insights from the massive amounts of data now available from internal and external sources, many companies are spending heavily on IT tools and hiring data scientists. Yet most are struggling to achieve a worthwhile return. That’s because they treat their big data and analytics projects the same way they treat all IT projects, not realizing that the two are completely different animals”.

    tags: hbr analytics bigdata

  • Disruptions: Design Is Driving Technology Forward – NYTimes.com

    “We’re on the tail end of technology being special,” says John Maeda, president of the Rhode Island School of Design. “The automobile was a weird alien technology when it first debuted, then, after a while, it evolved and designers stepped in to add value to it.”

    …“We have this exciting next step for design,” he said. “Now that we have enough technology to do anything, design can now begin to be better than the technology itself.”

    tags: technology design maeda

Posted from Diigo. The rest of my favorite links are here.