## Chapter 27 — Human factors and cyber policy: control design ### Lesson map Lesson 27 published. Map, example, EX079. ```mermaid flowchart TD N0["Learning outcomes"] N1["27.1 Supporting controls"] N2["27.2 Ethical nudges"] N3["27.3 Verification procedures"] N4["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 N4 --> EX["Worked example"] EX --> Q["Exercise EX079"] ``` ### Logical drawing ```mermaid flowchart LR N0["Learning outcomes"] N1["27.1 Supporting controls"] N2["27.2 Ethical nudges"] N3["27.3 Verification procedures"] N4["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"] ``` ```text [Learning outcomes] | v [27.1 Supporting controls] | v [27.2 Ethical nudges] | v [27.3 Verification procedures] | v [Synthesis] | v [Worked example] --> [Exercise EX079] ``` ### Learning outcomes You will (1) design controls that support people rather than test them; (2) apply nudges ethically; (3) design verification procedures for high-risk requests. ### 27.1 Supporting controls Aiko designs controls that help staff do the right thing. Payment change requests trigger an automatic hold and a callback by a second person using a number from the supplier file, not from the request. Remote vendor sessions require a ticket number and approval in the maintenance system. External emails with names matching staff show a specific warning. Each control removes the need for a lone judgement under pressure. Saltzer and Schroeder (1975) called this psychological acceptability: controls that are easy to use correctly are used correctly. ### 27.2 Ethical nudges Aiko considers nudges, small design changes that make the secure choice easier or more visible. Examples include making the report button the most prominent action, setting secure defaults for file sharing and showing a short reminder when someone forwards internal files externally. She sets ethical limits: nudges must be transparent, easy to override when there is a good reason and never manipulative. A nudge that tricks people would damage trust and contradict the respect for staff that the programme depends on. ### 27.3 Verification procedures For high-risk requests, such as changes to treatment plant settings requested by phone, Aiko writes a verification procedure: record the request, hang up, call back using the official number, confirm with a second engineer and log the outcome. The procedure takes about three minutes. She tests it with five engineers using role-play with a colleague acting as a caller, not a real deception exercise. All complete it correctly after one practice, and they suggest a laminated card by the phone. The card lists the official numbers and the steps in plain words. ### Worked example Aiko designs payment, vendor and email controls that remove lone judgements, sets ethical limits on nudges and tests a callback procedure by role-play. > **Synthetic case.** Controls and tests are synthetic; Saltzer and Schroeder (1975) is real. ### Errors and limits Callback procedures fail if supplier files are wrong. Nudges lose effect over time. ### Exercises - **EX079 — Callback number source.** Where must the callback number come from? *Rubric:* 3 = the supplier file, not the request;; 2 = known source;; 1 = the request;; 0 = none. - **EX080 — Nudge limits.** What ethical limits apply to nudges? *Rubric:* 3 = transparent, easy to override and never manipulative;; 2 = two;; 1 = vague;; 0 = none. - **EX081 — Role-play not deception.** How was the verification procedure tested? *Rubric:* 3 = role-play with a colleague acting as caller;; 2 = role-play;; 1 = real deception;; 0 = none. ### Synthesis Controls should support people with easy, transparent steps that remove lone judgements under pressure. ### Continue studying — chapter 27 of 50 [← Chapter 26 (draft)](#ch-26) · [Course chapter index](../SUBJECTS.md) · [Chapter 28 (draft) →](#ch-28) ## Worked answers **EX079.** From the supplier file, never from the request itself. **EX080.** They must be transparent, easy to override and never manipulative. **EX081.** Through role-play with a colleague acting as the caller, not a deception exercise.