Session type:

Workshop

Presented by:

Charles Weir

Lancaster University

Anna Dyson

Lancaster University

Session time:

07 Oct 11:15 — 12:45

Session duration:

90 minutes

About the session

How can we best help product owners with cybersecurity and privacy? In this workshop we’ll explore a novel approach, Cybersecurity Jujutsu: changing the way we talk about security and privacy issues. You don’t need cyber knowledge to attend. We’ll learn the latest GCHQ-recommended risk-based analysis approach, then we’ll take the highest priority problems and explore how to ‘flip’ them, and use their threateningness to make them valuable to our product owner.

The workshop addresses a major problem: even when you know exactly what all the potential cyber security problems may be for your project, in practice it must be the product owner who makes the decisions about whether to incorporate them into the product. When those decisions are represented as “a bad thing may happen”, product owners tend naturally to ignore them; the experience of many of the teams we have worked with has been that cyber problems never get addressed or fixed.

For some problems, that will a good business decision; for others a decision to ignore them could prove fatal to the organisation. So, it is vital for developers help product owners to reason effectively about cyber problems. The ‘cybersecurity jujitsu’ approach of flipping cyber threats—identifying the positive benefits of fixing them—does exactly that. We have trialled it in a wide variety of teams, have found it highly effective in improving product owner engagement with cyber issues, and have identified many different ‘jujutsu’ techniques. It is those techniques that will be introduced with the experiential learning in this workshop.

Participants Takeaways:

  • Anyone can understand and make cybersecurity decisions
  • A simple technique for risk-based analysis of cyber problems in practice
  • An effective approach to talking cyber with product owners
  • Techniques for cybersecurity jujutsu: finding the positive in cyber problem

This session has:

  • A session number cap: 48 participants

Themes: Security, Communication, Decisions, Developer, Product Development, Solutions Focus

About the speaker(s)