You're tasked with maintaining user experience and data security. How do you strike the right balance?

I took a month as a Director of Info Sec and just shadowed our workers. I quickly made a lot of changes as I could see where Info Sec had become a high priority than the business. Also areas to make simple changes to have big user satisfaction for example moving to push notifications for MFA.

This question touches various aspects of Ux, Workflow Design, Design thinking, Data Collection, Information Security and Operational Risk. Perhaps, Six Sigma principles that apply will also help find a balance. Business process workflow design should be designed to deliver value to clients / stakeholders, ensuring that all the relevant inputs, processing, outputs and data collection is as efficient as possible - ensuring Ux, Cx and Bx (Brand Xperience). Adopting some of the best practices effectively, will yield a good balance. Mapping processes (SIPOC), defining data collection and plan for data visualization, data classification and LAM (ISO 27001), Operational risk controls to mitigate risk. All risk controls must be efficient.

Para un equilibrio adecuado, es importante informar a los usuarios los riegos a los que estamos expuestos, y el porque es necesario implementar controles. Estos controles se deben dise?ar para que el usuario interactúe de forma simple, pero garantizando la seguridad de los datos, lo que se logra con técnicas de encriptación para minimizar brechas de seguridad. La retroalimentación de los usuarios, la mejora continua, las pruebas de usabilidad y un constante monitoreo generan confianza el la protección de los datos y hacen que el usuario despierte y trabaje en ese sentido de responsabilidad.

This perspective is spot on. Prioritizing user engagement and feedback is crucial in crafting a security strategy that aligns with real-world needs. By deeply understanding user's workflows and challenges, we can design security measures that feel like a natural extension of their tasks, rather than an obstacle. This empathetic approach not only enhances security but also strengthens user trust and satisfaction, as they see that their needs are being thoughtfully addressed. It’s a win-win for both user experience and data security.

It is one of the aspects of human-centred design and cannot be omitted from selecting IS solution that best meet user needs. One example is using code-generating authenticator apps for MFA rather than SMS for users who travel between different countries and need to change SIM cards etc.

Not sure if education of users on the purpose of every layer is that crucial: it would be more appropriate to demonstrate to the users that they themselves are one of the security layers and how they should operate in such context, including the other layers that are visible and relevant to them.

Explain the necessity of each security layer without overwhelming users with technical jargon. Brief, focused messages on how layers like MFA or firewalls protect them can foster trust. Provide users with choices when possible, such as opting for MFA methods they find convenient (e.g., SMS, app-based authentication, or biometrics). Always create comprehensive defense that works unobtrusively in the background. When users understand how these layers operate to safeguard their data, they’ll be more likely to appreciate and adopt security measures, helping security and user experience work hand-in-hand.

This analogy of security as an onion is an excellent way to visualize a multi-layered approach. Each layer adds a critical defense mechanism, creating a resilient system that can withstand diverse threats.

An alternative to Role-Based Access Control (RBAC) is Attribute-Based Access Control (ABAC), which provides even more flexibility. Instead of just looking at a user's role, ABAC considers additional factors like the time of access, where the user is, and what device they're using. This allows for more precise control over who can access what information. While ABAC can be more complicated to set up, it’s very useful in situations where the user's needs and roles change frequently. Both RBAC and ABAC are effective, and the best choice depends on what your organization or user needs.