OpenCyber Academy
Bachelor's · Chapter 23 · English
Course code: OCA-098Chapter 23: OCA-098-C023

Chapter 23 — Human factors and cyber policy: methods I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Survey analysis"]
  N2["Lab — Counting reported barriers"]
  N3["23.2 Coding interviews"]
  N4["23.3 Combining findings"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Survey analysis"]
  N2["Lab — Counting reported barriers"]
  N3["23.2 Coding interviews"]
  N4["23.3 Combining findings"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX067"]
[Learning outcomes]
    |
    v
[23.1 Survey analysis]
    |
    v
[Lab — Counting reported barriers]
    |
    v
[23.2 Coding interviews]
    |
    v
[23.3 Combining findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) analyse survey data on reporting barriers; (2) code interview responses into themes; (3) combine both into findings.

23.1 Survey analysis

Nadia's anonymous survey received 84 responses from 120 staff. She asked which barriers made reporting less likely, allowing several answers. The lab counts how often each barrier was chosen. The most common barrier is uncertainty about whether an email is suspicious enough, followed by not knowing how to report and worry about looking foolish. She reports counts and percentages, and notes that respondents may differ from non-respondents, perhaps being more engaged, so the results describe those who answered rather than all staff. She shares the counts with staff.

Lab — Counting reported barriers

# Barrier counts from 84 synthetic survey responses (multiple choice).
b = {"unsure if suspicious enough": 45, "don't know how to report": 28, "worry about looking foolish": 19, "too busy": 17, "never hear back": 12}
for k, v in sorted(b.items(), key=lambda x: -x[1]): print(f"{k}: {v}/84 = {v / 84:.0%}")

Run with python3 lab_barriers.py. Verified output:

unsure if suspicious enough: 45/84 = 54%
don't know how to report: 28/84 = 33%
worry about looking foolish: 19/84 = 23%
too busy: 17/84 = 20%
never hear back: 12/84 = 14%

23.2 Coding interviews

Nadia interviews eight counter staff for about twenty minutes each, taking notes without names. She reads the notes several times and labels passages with codes such as unsure, busy, no reply and embarrassed. She groups codes into themes: uncertainty, time pressure, lack of feedback and social risk. A second student codes two interviews independently and they compare, discussing disagreements to refine the code definitions. This simple check improves consistency and makes the coding less dependent on one person's interpretation. They agree on most codes.

23.3 Combining findings

Nadia combines survey and interviews. The survey shows uncertainty is the most common barrier; interviews explain it: staff fear wasting IT's time and have never been told that unsure reports are welcome. Lack of feedback appears in interviews though not in the top survey choices, suggesting it matters more than the survey captured. Her findings are that Ashcombe should tell staff explicitly to report when unsure, make reporting quicker and reply to every report. Each finding is linked to its evidence.

Worked example

Nadia counts barriers from 84 survey responses, codes interviews into themes with a second coder and combines the methods into findings.

Synthetic case. Data are synthetic.

Errors and limits

Survey response bias. Coding remains interpretive.

Exercises

Synthesis

Surveys show how common barriers are and interviews explain why they matter.

Continue studying — chapter 23 of 40

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →

Worked answers

EX067. 70%, since 84 of 120 staff responded.

EX068. Being unsure whether an email was suspicious enough, chosen by 45 of 84 (54%).

EX069. To check and improve the consistency of coding.