It was the year 2007, and a designer at General Electric, Doug Deeds, just finished a two and half year project designing an MRI machine. When he got the opportunity to see it in action at a local hospital, he jumped at the chance. Standing next to his new machine, Doug admired his work. He saw this gleaming white machine in a sanitized room, and the sound of the machine sounded like a beautiful melody to him.
A short while later, the technician taps him on his shoulder and asks him to step out as a patient is coming in for a scan. He steps out and stands on the outside of the room and looks in through a window. A little girl comes in. After a while, he notices that the little girl is crying. Her father kneels and tells her “My girl, we talked about this, you need to be brave”. The technician then calls the anaesthesiologist as the girl needs to be sedated. Doug asked the technician how often this happens, the technician says, “oh, it is quite common. As much as 80% of all children must be sedated as they are simply too scared”.
Doug was heartbroken. Suddenly, Doug now sees this machine and room from the perspective of the little girl. He sees yellow and black lines on the floor showing where you are allowed to move, like an accident scene. On the wall is a huge magnet with a danger sign on it, and the sound of the machine now sounds like a monster to him.
Upon reflection, Doug realises that he needs to adopt a human centric design approach; and he does exactly that. They put stickers on the floor that look like little rocks, and they tell the kids they must walk on the rocks as they enter. They played waterfall sounds and changed the flatbed into a canoe, and kids are told if they stay still, fish might jump out of the water. This completely transforms the entire experience. The result is that from 80% of children that previously needed to be sedated, now less than 20% of children must be sedated. Satisfaction scores also went up to 90%.
When it comes to securing systems and data, we can learn from this. As designers and builders of solutions, we are always looking for ways to do things faster, cheaper, and better. Our customers, however, look at experience. As designers and practitioners, we need to have empathy, and design with the customer in mind. We must acknowledge that on the other side of every security feature that we enable or enforce, is a human that must use it (or an organisation that will pay the price if the customer concludes it requires too much effort). Security therefore is no longer just about securing things; it is now also about customer conversation and retention.
