Chapter 31 — Human factors and cyber policy: advanced cases
Lesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 Volunteers and insiders"]
N2["31.2 Security and service values"]
N3["31.3 Proportionate responses"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 Volunteers and insiders"]
N2["31.2 Security and service values"]
N3["31.3 Proportionate responses"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 Volunteers and insiders]
|
v
[31.2 Security and service values]
|
v
[31.3 Proportionate responses]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) analyse cases involving insiders, volunteers and the public; (2) weigh security against service values; (3) design proportionate responses.
31.1 Volunteers and insiders
Ashcombe relies on forty volunteers who help with events and homework clubs. Some need access to booking systems. Nadia analyses a synthetic case in which a volunteer shares a staff login so that a friend can book rooms. The intent is helpful, not malicious, but it bypasses accountability. She learns that most insider problems involve convenience and goodwill rather than malice. Treating volunteers as suspects would damage relationships that the library depends on, so the response must address the convenience gap without assuming bad intent.
31.2 Security and service values
Libraries value openness, privacy and access for all. Public computers must be easy to use for people with limited digital skills. Nadia considers a proposal to require identification for public computer use to deter misuse. She weighs it against library values: identification would exclude some vulnerable users and create records of what people do. She concludes that time limits, automatic session clearing and network filtering for malware achieve most security aims without harming access. Security choices must fit the mission of the organisation they protect.
31.3 Proportionate responses
Nadia develops a principle of proportion: responses should match the risk and respect people's roles. For the shared login case, she proposes a simple volunteer account with booking rights only, created within a day of request. For public computers, she keeps the open model with technical safeguards. For staff, she relies on support rather than surveillance. Proportion prevents overreaction after incidents, which can impose heavy burdens on everyone because of one event, and it keeps the programme aligned with the organisation's values.
Worked example
Nadia analyses a volunteer login-sharing case, weighs identification against library values and sets proportionate responses.
Synthetic case. Cases are synthetic.
Errors and limits
Proportion requires judgement. Open models carry residual risk.
Exercises
- EX091 — Insider motive. What usually drives insider problems according to the chapter? Rubric: 3 = convenience and goodwill rather than malice;; 2 = convenience;; 1 = malice;; 0 = none.
- EX092 — Identification rejected. Why did Nadia reject identification for public computers? Rubric: 3 = it would exclude vulnerable users and create records;; 2 = access;; 1 = vague;; 0 = none.
- EX093 — Volunteer fix. What fix addresses the shared login? Rubric: 3 = a volunteer account with booking rights only;; 2 = role account;; 1 = ban;; 0 = none.
Synthesis
Proportionate responses match risk to roles and protect the organisation's mission.
Continue studying — chapter 31 of 40
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →