People, process, technology - who done it? A security architecture investigation

Breaches rarely occur as the result of single failures and are more often than not a result of a combination of gaps across people, process, and technology.

This session repositions incident analysis as an interactive "whodunit" murder mystery investigation, designed to explore how these elements intersect and how security architecture can better account for failure.

Attendees will take on the role of the jury in a live investigation centred around a single, realistic incident scenario inspired by common patterns observed in security operations.

The case will follow the basic structure of your favourite murder mystery, starting from the setup, the investigation, the major turning point and the final resolution. In classic murder mystery fashion, participants will be encouraged to determine the likely cause of the incident (people, process, or technology) before further evidence is revealed.

As the investigation progresses, initial assumptions will be challenged. What presented as a classic case of user error or a technology failure begins to reveal deeper, interconnected issues placing us at our major turning point. This leads to the crucial realisation that security failures are rarely due to a single domain failure but instead come about as a result of layered weaknesses across multiple areas.

The session then shifts into analysis where the incident is broken down into contributing factors that are mapped directly to security architecture considerations. This will include examining missing controls, failed assumptions and how the environment could have been designed to better prevent, detect, or contain the incident.

In our fourth act we will conclude the session with a "cause of death" style summary, highlighting how people, process, and technology each contributed to the failure and resolving our investigation. The goal is to reinforce the importance of designing security architectures that account for failure across all layers calling an ode to the defense-in-depth strategy.

In order to reinforce the framework's practical application, participants will be encouraged, if time allows, to apply this method to another case or consider how such patterns might exist in their own surroundings.

Closing note: Security didn’t die because of one mistake; it died because the system was never designed to survive failure.