Porosity (PO) Suit

DBD Cornucopia > Deck > Porosity

The Porosity (PO) suit is a clustering of threats around amenability of services to constitute new functions by integrations with wider ecosystems, in a way that builds on and complements the public service without separation, and requiring sharing and overlaps of provision.

All six suits are broad groupings of threats which, while useful for game play, should not be allowed to restrict thinking about either where and how the threats defined on each card could or do arise, nor the types and locations of harms occuring. If suits overly dominate thinking, it can be useful to think about 'what would be revealed if this threat card was in a different suit?'.

The other suits in the deck are: Scope, Architecture, Agency, Trust and Cornucopia (plus Jokers).

Thirteen Cards in the Porosity Suit

Each suit is a broad grouping of threats, and are relevant to all sort of implementation team roles and stages of the service lifecycle. The suit names should neither constrain thinking about implementation choices which may cause the threat, nor restrict the types of harm identified.

Luna completes the service without creating, publishing, documenting maintaining and supporting integration points, such as a public API, messaging protocol or batch data processes, resulting in the system being isolated from wider community assets

PO-2

Teddy expressly discourages third party service integration either overtly (e.g. banning such integrations in terms of use, making integration illegal) or covertly (e.g. extensibility and customisability not promoted, blaming integrations for problems, failing to maintain integration points such as an API, deliberately breaking integrations)

PO-3

Maisie contrives to make integrations more difficult than necessary for third parties to extend and/or customise the service (e.g. the use of randomised or inconsistent URL paths or page object names, dynamic code included at run-time, use of unstructured data, customised data encoding and decoding, changing page structure or content without notification, use of anti-web browser extension techniques, blocking screen-sharing)

PO-4

Joseph does not recognise how third party assistance or integrations are vital to support continued adoption and use of the service by claimants, and allows those to deteriorate, fail, be deprecated or be retired

PO-5

Oliver excludes and/or prevents the inclusion of generic third party static guidance and help for claimants (e.g. general guidance)

PO-6

Lara builds the service without capability for incorporating individually personalised third party static guidance and help for claimants (e.g. Individual textual reminder notes, selected video how-to guides)

PO-7

Harry fulfils the service but without the possibility for including live (synchronous) third party guidance and help (e.g. live chat, shared screen)

PO-8

Muhammad conceives no way for claimants to selectively transfer, export, send or otherwise move data already in the system to someone or somewhere else, and/or the data is only made available in unstructured formats

PO-9

Samuel puts into practice a system without supporting, or making it very difficult, for third parties to access the service together with claimants and/or on their behalf (e.g. shared-use, assisted use, indirect intermediated use, proxy use), and to do so regularly, periodically, occasionally or as a one-off

PO-10

Beatrice puts together provision for third party access to the system, but it lacks sufficient granular controls for claimants to define access timing, duration, features and view/add/update permissions, logging and monitoring

PO-J

Matilda delivers the service without prompts for claimants explaining when, why or how to get professional independent advice, and/or without outlining the risks involved of seeking such advice or not seeking such advice

PO-Q

Jude digitises the service which does not recognise, promote and support the synergistic effects wider ecosystems can offer claimants

PO-K

You have invented a new implementation decision related to porosity of the system that is harmful to claimants

PO-A

Note About Card Values

Card values (e.g. 3, 8, King) are for game play and are not correlated with the severity of harm. This is because threats cannot be ranked directly since they can affect individuals in different ways due to situations and circumstances, or affect fewer or more claimants, or the harms can arise in claimants' support networks and wider society.