MIT Sloan Management Review Article on Design for Cybersecurity From the Start

Everyone understands how important security is to digital products and services. Customers expect digital offerings to be secure, especially when they’re incorporating them into their own products and services. For example, a manufacturer that includes a sensor in its product design expects the sensor it uses to be cybersecure and not introduce vulnerabilities. Any device connected to the internet can create an entry point for attacks that access the internal system, steal credentials, plant malware, or collect sensitive data. But as breach after well-publicized breach shows, our development processes to build cybersecurity into products and services continue to break down. We have not yet reached the point where security is not only expected but deeply embedded in every aspect of product development.

To build truly secure digital products and services (which we’ll refer to as either “products” or “offerings” for simplicity’s sake), cybersecurity must be baked in from the initial design stage. While this isn’t easy, doing so can keep costs in check and help organizations better meet customer expectations. However, too often security is an afterthought, addressed only after a product has already been designed.

About the Author

Keri Pearlson is the executive director of the research consortium Cybersecurity at MIT Sloan (CAMS).

Keman Huang is an associate professor at Renmin University of China and a research affiliate at the MIT Sloan School of Management.

Learn more about MIT SMR.