Principles of design in cyber risk management

How the principles of redundancy, weakest link and forgiveness apply to cybersecurity.

A few years ago, I took a great LinkedIn Learning course, The Universal Principles of Design, which covers 50+ core design principles. When you think about good design, what comes to mind? Maybe something colourful like album covers or sleek like a luxury car. But design is much more than that!  

Design principles are fundamental pieces of advice that you can apply to improve things and protect yourself from mistakes or harm in your job or everyday life. They are particularly useful when talking about any form of risk management—how can we learn from collective human knowledge to avoid worst-case scenarios? 

Each lesson in the course I took covers a principle and uses a real-life example to demonstrate the principle in action or explain its origin. The examples range from preventing catastrophes like planes crashing to building better ballots in elections. 

Good design built into a defensive strategy for organizations helps prevent cyber attacks that can compromise systems and data, cause downtime, require costly recovery measures, ruin brand reputations and more. Here are three design principles and how they apply to the realm of cyber risk management within an organization. 

1. Redundancy 

Redundancy is to have a backup that keeps things working in the event of a failure. There are four types of redundancy:  

1. Additive: multiple elements of a single type 

2. Diverse: multiple elements of different types 

3. Active: element is applied at all times 

4. Passive: applied only in the event of a failure 

Example of redundancy in everyday life: keeping a spare tire in the trunk 

Example of redundancy in cyber risk: data backups. Here is what the Cyber Centre states about backups:  

Data backups are a critical piece of the effort to ensure quick recovery not only from cyber security incidents such as ransomware or malware but also from natural disasters, equipment failures, or theft… Organizations should ensure that they store backups in a secure, encrypted state. Backups should only be accessible to those responsible for the testing and/or use of restoration activities. Organizations should also consider storing backups offsite (either physically or via cloud services) to provide diversity in the event of a disaster (fire, flood, earthquake or localized cyber security incident). 

Scott McMullen, CIRA’s Manager of Network & Security says, “Diversity in your cybersecurity tools and vendors can contribute to redundancy. In the event that there’s an outage with one vendor, you have a working backup in place to protect your data and systems.” 

Note: redundancy is good practice, but it can add cost, weight and complexity to a system. Take MFA for example. While it prevents cyber criminals from attacks that are low-hanging fruit (i.e. easy-to-crack passwords), there has been a struggle with hesitation, outright refusal, or revocation of implementing MFA, leaving organizations vulnerable to cyber attacks. At the end of the day, MFA is a recommended and proven way to protect your organization—users should be able to handle a few extra seconds to log into systems, but it may take some getting used to. 

2. Weakest link 

The weakest link is when an element will fail in order to protect other elements in the system from damage. It’s also a great game show. 

Example of the weakest link in everyday life: fuses are designed to fail so that a power surge doesn’t damage an electrical circuit.  

Example of the weakest link in cyber risk: human error is involved in 95-98% of cyber incidents. This could involve actions like clicking a link or transferring money to the wrong destination. This is because cyber criminals use social engineering to exploit the emotions and vulnerability of humans.  

It’s often said that humans are the weakest link in cybersecurity. But just like a fuse, they can also be your greatest strength. Our 2021 Cybersecurity Survey found that 95% of IT managers agreed that cybersecurity awareness training was effective in reducing the number of cyber incidents in their organization. You may want to look into addressing high-risk cyber groups such as the C-Suite and the finance department and helping them become cybersecurity champions in your organization.  

3. Forgiveness 

Forgiveness is a concept that first seeks to help humans avoid errors and then protects them from harm when they do make an error.  

Example of forgiveness in everyday life: rumble strips/sleeper lines on the side of a highway alert and prevent drivers from veering out of their lane. 

Example of forgiveness in cyber risk: a little education goes a long way, but cybersecurity awareness training does not eliminate incidents. We are all human after all and even the most tech-savvy employee can be caught off-guard on a bad day. Applying the principle of forgiveness for phishing emails, a firewall that blocks access to malicious URLs can prevent cyber attacks in the event that an employee does click on a phishing link. 

Design principles as applied to cybersecurity  

We can all learn something from established design principles. They can be applied to any industry to prevent worst-case scenarios and cybersecurity risk management within organizations is no exception. 

For further reading, here’s a great article on security-specific design principles such as least privilege and psychological acceptability. If you’re looking at building a mature cyber risk management strategy in your organization, these design principles are good to keep in mind.