Chapter 27 — Human factors and cyber policy: verification

Chapter 27 — Human factors and cyber policy: verification

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Specified behaviour"]
  N2["27.2 User-side checks"]
  N3["27.3 Recording evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Specified behaviour"]
  N2["27.2 User-side checks"]
  N3["27.3 Recording evidence"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Specified behaviour]
    |
    v
[27.2 User-side checks]
    |
    v
[27.3 Recording evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) verify that controls work as specified; (2) check controls from the user's side; (3) record verification evidence.

27.1 Specified behaviour

Verification checks that each control does what it should. Nadia lists specifications: the button appears in every staff mailbox; reports arrive in the shared mailbox; an acknowledgement is sent within a minute; replies are sent within one working day; and the phone procedure card is at every counter. She tests each with synthetic emails and a branch visit checklist. Verification differs from evaluation: it does not ask whether reporting improved, only whether controls are in place and functioning correctly. IT agrees the list first.

27.2 User-side checks

Nadia checks controls from the user's side, not just from IT's console. She logs in with a test staff account on a counter computer and a laptop and reports a synthetic email. On the counter computer, the button is hidden behind a menu because of a smaller screen setting. IT adjusts the layout. She also asks three staff to find the phone procedure card; one branch had put it in a drawer. User-side checks reveal problems that technical checks miss, because they test what people actually see.

27.3 Recording evidence

Nadia records each check with date, method, result and fix. Of eight checks, six passed first time and two were fixed and retested. She stores the record with the programme documents so it can be repeated after changes. Recording failures and fixes demonstrates that verification was genuine rather than a formality. Dr Prescott notes that small organisations often skip this step, but the record becomes valuable when staff change or when auditors ask how controls were checked. The record is two pages long.

Worked example

Nadia verifies five specifications, finds a hidden button and a misplaced card through user-side checks and records eight checks.

Synthetic case. Checks are synthetic.

Errors and limits

Checks show a moment in time. Layout changes can reintroduce problems.

Exercises

• EX079 — Verification versus evaluation. What does verification not ask? Rubric: 3 = whether reporting improved;; 2 = outcomes;; 1 = vague;; 0 = none.
• EX080 — Counter problem. What problem appeared on counter computers? Rubric: 3 = the button was hidden behind a menu;; 2 = hidden;; 1 = vague;; 0 = none.
• EX081 — Check record. How many of eight checks passed first time? Rubric: 3 = six;; 2 = 6;; 1 = vague;; 0 = none.

Synthesis

Verification checks controls from both technical and user sides and records evidence.

Continue studying — chapter 27 of 40

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →