Chapter 15 — Security fundamentals
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Concepts and people"]
N2["15.2 Social engineering"]
N3["15.3 Threats at Greyford"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Concepts and people"]
N2["15.2 Social engineering"]
N3["15.3 Threats at Greyford"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Concepts and people]
|
v
[15.2 Social engineering]
|
v
[15.3 Threats at Greyford]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) relate core security concepts to human behaviour; (2) recognise social engineering techniques; (3) map human-targeted threats at Greyford.
15.1 Concepts and people
Aiko connects confidentiality, integrity and availability to human actions. A field engineer sharing a password harms confidentiality; an operator acting on a forged instruction harms integrity; a ransomware infection started by a malicious attachment harms availability. People appear in every part of security, as attackers, targets and defenders. Seeing people as defenders as well as targets changes design priorities towards supporting good behaviour rather than only restricting bad behaviour. She writes one example of a person as defender for each goal, such as an engineer reporting a strange vendor call before acting on it.
15.2 Social engineering
Aiko studies how attackers manipulate people. Cialdini's (2021) principles of influence, such as authority, urgency, scarcity, reciprocity, liking and social proof, explain why lures work. Hadnagy (2018) describes how social engineers combine research about targets with these principles. A fake message from the chief executive asking for an urgent payment uses authority and urgency together. Recognising the principles helps staff spot pressure, and it helps designers add pauses where pressure is likely. She builds a one-page table mapping each principle to a typical lure and a simple pause that interrupts it, which becomes part of later training.
15.3 Threats at Greyford
Aiko maps human-targeted threats: phishing for remote access credentials, phone calls pretending to be vendors asking operators to change settings, invoice fraud against finance and tailgating at depots. For each she notes the influence principle used and the control that removes reliance on judgement, such as callback verification for vendor requests. The Verizon Data Breach Investigations Report (2024) is one annual source that tracks the human element in breaches, which she cites as context rather than as Greyford data. She keeps the map short enough to review each quarter.
Worked example
Aiko links security goals to human actions, applies influence principles to lures and maps four human-targeted threats with controls.
Synthetic case. Threats at Greyford are synthetic; Cialdini (2021), Hadnagy (2018) and the Verizon DBIR (2024) are real.
Errors and limits
Influence principles explain but do not predict individual behaviour. Industry reports may not match a utility's risks.
Exercises
- EX043 — People as defenders. Why see people as defenders too? Rubric: 3 = it shifts design towards supporting good behaviour;; 2 = support;; 1 = vague;; 0 = none.
- EX044 — CEO lure. Which principles does a fake urgent CEO payment request combine? Rubric: 3 = authority and urgency;; 2 = two;; 1 = vague;; 0 = none.
- EX045 — Vendor call control. Which control addresses fake vendor phone calls? Rubric: 3 = callback verification using a known number;; 2 = callback;; 1 = vague;; 0 = none.
Synthesis
People are targets and defenders; understanding influence helps design controls that reduce reliance on judgement under pressure.
Continue studying — chapter 15 of 50
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →