Chapter 22 — Human factors and cyber policy: system and data models

Lesson map

Lesson 22 published. Map, example, EX064.

flowchart TD
  N0["Learning outcomes"]
  N1["22.1 The programme as a system"]
  N2["22.2 Data flows"]
  N3["22.3 Decision points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX064"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["22.1 The programme as a system"]
  N2["22.2 Data flows"]
  N3["22.3 Decision points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX064"]

[Learning outcomes]
    |
    v
[22.1 The programme as a system]
    |
    v
[22.2 Data flows]
    |
    v
[22.3 Decision points]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX064]

Learning outcomes

You will (1) model the awareness programme as a system; (2) model data flows for reports and simulations; (3) identify where people make decisions.

22.1 The programme as a system

Aiko models Greyford's awareness programme as a system with inputs, processes and outputs. Inputs include threat intelligence, staff needs and policy requirements. Processes include training, simulations, reporting, triage and feedback. Outputs include faster reporting, fewer successful attacks and evidence for the regulator. Modelling the programme this way shows that training is only one process among several, and that the output Greyford cares about depends on reporting and triage working well together. She draws the model as a one-page diagram and uses it to explain to managers why investing only in training would leave most of the system unchanged and the outcomes they want largely unaffected.

22.2 Data flows

Aiko draws data flows: staff report emails to the triage system; triage sends verdicts back to reporters; simulation results flow as aggregates to a dashboard; training completion flows to human resources records. She marks where personal data appears and where it is aggregated. One flow worries her: the simulation tool exports individual results by default to a spreadsheet that managers can open. She recommends turning off the export and configuring aggregate reporting only, consistent with the policy from chapter 13. The vendor confirms the change can be locked by administrators.

22.3 Decision points

Aiko marks every point where a person makes a decision: an employee deciding whether to report, a triage analyst deciding whether an email is malicious, a manager deciding whether to approve access, and an operator deciding whether to act on a phone request. For each she notes what information the person has, how much time and what pressure. Decision points with little information and high pressure, such as urgent phone requests, are where social engineering succeeds, so they deserve design attention first.

Worked example

Aiko models the programme as a system, maps data flows and stops an individual-results export, and marks decision points with their pressures.

Synthetic case. Models and tools are synthetic.

Errors and limits

Models omit informal channels like chat messages. Default settings change with tool updates.

Exercises

• EX064 — Programme output. Which output does Greyford care about most?
  Show marking criteria

  Rubric: 3 = faster reporting and fewer successful attacks;; 2 = outcomes;; 1 = completion;; 0 = none.
• EX065 — Export problem. What data flow worried Aiko?
  Show marking criteria

  Rubric: 3 = individual simulation results exported to a manager spreadsheet;; 2 = export;; 1 = vague;; 0 = none.
• EX066 — Risky decision points. Which decision points deserve attention first?
  Show marking criteria

  Rubric: 3 = those with little information and high pressure, like urgent phone requests;; 2 = pressure;; 1 = vague;; 0 = none.

Synthesis

Modelling the programme as a system reveals data risks and the pressured decision points where attackers succeed.

Continue studying — chapter 22 of 50

← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →