Chapter 27 — Human factors and cyber policy: control design | Engineering Human factors and cyber policy

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Supporting controls"]
  N2["27.2 Ethical nudges"]
  N3["27.3 Verification procedures"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Supporting controls"]
  N2["27.2 Ethical nudges"]
  N3["27.3 Verification procedures"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Supporting controls]
    |
    v
[27.2 Ethical nudges]
    |
    v
[27.3 Verification procedures]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) design controls that support people rather than test them; (2) apply nudges ethically; (3) design verification procedures for high-risk requests.

27.1 Supporting controls

Aiko designs controls that help staff do the right thing. Payment change requests trigger an automatic hold and a callback by a second person using a number from the supplier file, not from the request. Remote vendor sessions require a ticket number and approval in the maintenance system. External emails with names matching staff show a specific warning. Each control removes the need for a lone judgement under pressure. Saltzer and Schroeder (1975) called this psychological acceptability: controls that are easy to use correctly are used correctly.

27.2 Ethical nudges

Aiko considers nudges, small design changes that make the secure choice easier or more visible. Examples include making the report button the most prominent action, setting secure defaults for file sharing and showing a short reminder when someone forwards internal files externally. She sets ethical limits: nudges must be transparent, easy to override when there is a good reason and never manipulative. A nudge that tricks people would damage trust and contradict the respect for staff that the programme depends on.

27.3 Verification procedures

For high-risk requests, such as changes to treatment plant settings requested by phone, Aiko writes a verification procedure: record the request, hang up, call back using the official number, confirm with a second engineer and log the outcome. The procedure takes about three minutes. She tests it with five engineers using role-play with a colleague acting as a caller, not a real deception exercise. All complete it correctly after one practice, and they suggest a laminated card by the phone. The card lists the official numbers and the steps in plain words.

Worked example

Aiko designs payment, vendor and email controls that remove lone judgements, sets ethical limits on nudges and tests a callback procedure by role-play.

Synthetic case. Controls and tests are synthetic; Saltzer and Schroeder (1975) is real.

Errors and limits

Callback procedures fail if supplier files are wrong. Nudges lose effect over time.

Exercises

EX079 — Callback number source. Where must the callback number come from?
Show marking criteria
Rubric: 3 = the supplier file, not the request;; 2 = known source;; 1 = the request;; 0 = none.
EX080 — Nudge limits. What ethical limits apply to nudges?
Show marking criteria
Rubric: 3 = transparent, easy to override and never manipulative;; 2 = two;; 1 = vague;; 0 = none.
EX081 — Role-play not deception. How was the verification procedure tested?
Show marking criteria
Rubric: 3 = role-play with a colleague acting as caller;; 2 = role-play;; 1 = real deception;; 0 = none.

Synthesis

Controls should support people with easy, transparent steps that remove lone judgements under pressure.

Continue studying — chapter 27 of 50

← Chapter 26 (draft) · Course chapter index · Chapter 28 (draft) →