Chapter 24 — Human factors and cyber policy: controls

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Controls from findings"]
  N2["24.2 Ethical nudges"]
  N3["24.3 Assessing burden"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Controls from findings"]
  N2["24.2 Ethical nudges"]
  N3["24.3 Assessing burden"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Controls from findings]
    |
    v
[24.2 Ethical nudges]
    |
    v
[24.3 Assessing burden]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) design controls that address identified barriers; (2) apply ethical nudges; (3) assess controls for burden.

24.1 Controls from findings

Nadia designs controls linked to her findings. To address uncertainty, Ashcombe will state clearly that unsure reports are welcome and thank every reporter. To address difficulty, a report button will be added to the email client. To address lack of feedback, IT will reply within one working day with a short verdict. To address the phone impersonation risk, the no-disclosure rule and named contact will be introduced. Each control traces back to evidence, which helps managers see why it is needed and what it should change.

24.2 Ethical nudges

A nudge is a small design change that makes a choice easier without forcing it. Nadia proposes placing the report button prominently and showing a short reminder when external emails ask for payment or passwords. She sets limits: nudges must be transparent, staff must be able to ignore them and they must never manipulate people through fear. She notes that Bada, Sasse and Nurse (2019) warned that fear-based messages can backfire. Nudges respect autonomy while reducing the effort of doing the secure thing.

24.3 Assessing burden

Every control adds some effort. Nadia estimates the time each control costs staff per week: the report button saves time compared with forwarding; reminders add a few seconds; the no-disclosure rule reduces difficult phone conversations. She presents an overall estimate showing a net saving of staff time. She also notes that controls should be reviewed after three months for unexpected burden, such as reminders appearing too often. Assessing burden before rollout reflects the compliance budget idea and helps keep controls sustainable.

Worked example

Nadia designs four controls from findings, sets ethical limits on nudges and estimates staff burden.

Synthetic case. Controls are synthetic; Bada et al. (2019) is real.

Errors and limits

Burden estimates may be optimistic. Nudges fade with familiarity.

Exercises

• EX070 — Feedback control. Which control addresses lack of feedback?
  Show marking criteria

  Rubric: 3 = IT replies within one working day;; 2 = reply;; 1 = vague;; 0 = none.
• EX071 — Nudge limits. Which limits apply to nudges?
  Show marking criteria

  Rubric: 3 = transparent, ignorable and not fear-based;; 2 = limits;; 1 = vague;; 0 = none.
• EX072 — Review timing. When should controls be reviewed for burden?
  Show marking criteria

  Rubric: 3 = after three months;; 2 = three months;; 1 = vague;; 0 = none.

Synthesis

Controls traced to evidence, nudged ethically and checked for burden are more likely to last.

Continue studying — chapter 24 of 40

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →