Why do we need system-specific security requirements? Can't we just comply with instructions? Yes we can, and we must. But it's not enough.
A new system does new stuff (or familiar stuff in new ways) or we wouldn't bother constructing it. New stuff means new risk components (assets, threat sources, vulnerabilities) and consequently new risk. New risk means we cannot simply rely on old rules. We need to rethink how security is implemented for this very system. System-specific security requirements.
(some of) my events
- 2023-11-16 Psychological perspectives on understanding human decision-making in situations involving risk and uncertainty (attending symposium, Stockholm)
- 2023-08-23--24 Riskbaserat arbetssätt (teaching course, Stockholm)
- 2023-05-30 Informationssäkerhet och risk (pod interview in Swedish)
- 2023-05-11 Certifierad IT-arkitekt (guest lecturing, Stockholm)
- 2022-12-05 Datavetenskapliga programmet (guest lecturing, University of Gävle)
Subscribe to:
Post Comments (Atom)
20230802
No comments:
Post a Comment