Treat Security Controls as Products Employees Choose to Use
Summary
A cybersecurity practitioner argues that security teams should design controls around employees’ work, explain their value, and involve users in decisions. Examples include removable-media restrictions and a collaborative ZTNA rollout.
Key points
- The author recommends explaining the risk and evidence behind controls, managing their effectiveness, and improving them when they do not work.
- In a past role, the author’s team researched employees’ removable-media needs before blocking USB mounting, then created an approval process for exceptions.
- Empathy, a blameless culture, and recognition of successes can help employees accept security controls.
- The article suggests using jobs-to-be-done principles to align security programs with business needs and participatory design to incorporate user feedback.
- The author says these approaches informed a 2024 ZTNA implementation that addressed employee pain points while enhancing security.
Article Details
- Topic
- Product-oriented security program design focused on aligning controls with employee workflows, business risk, and user needs.
People
Bob MoestaNamed as a co-inventor of the jobs-to-be-done framework discussed in the article.Chris CamachoAdded the editor's note to the article and is identified as Abstract's contributor.Clayton ChristensenNamed as a co-inventor of the jobs-to-be-done framework discussed in the article.Joseph McMahonCybersecurity architect and engineer who wrote the article about treating security programs as products.
Products
EDRon removable media (USB drives). As a result, we disabled mounting of removable media on endpoints via our EDR tooling. We knew this would be unpopular, so we took the product approach. We conducted internal researchVPNSVP of Engineering at the time say that the new solution was "way better, faster, and easier" than the old VPN-based solution was a highlight of my career.ZTNAthe jobs to be done framework and participatory design together informed a zero trust network access (ZTNA) implementation project I executed in 2024. We made the problem large, the risk visible, and the benefits