Chapter 32 — Human factors and cyber policy: reliability
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Human reliability"]
N2["32.2 Independent checks"]
N3["Lab — Independent and common-cause failure of checks"]
N4["32.3 Common-cause failures"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Human reliability"]
N2["32.2 Independent checks"]
N3["Lab — Independent and common-cause failure of checks"]
N4["32.3 Common-cause failures"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Human reliability]
|
v
[32.2 Independent checks]
|
v
[Lab — Independent and common-cause failure of checks]
|
v
[32.3 Common-cause failures]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) analyse the reliability of human-dependent controls; (2) compute the effect of independent checks; (3) recognise common-cause failures.
32.1 Human reliability
Every control that depends on a person can fail when that person is tired, rushed or distracted. Aiko treats the callback control as a system with a failure probability. If one officer skips the callback in five percent of cases under pressure, a single-officer control fails about one time in twenty. A second independent check reduces this, but only if the checks really are independent. Reliability analysis helps Greyford see where to add checks and where a technical control would be more dependable than any procedure.
32.2 Independent checks
The lab computes the probability that a fraudulent payment change passes when each of one, two or three independent checks fails with a given probability. With a 5% failure rate, two independent checks fail together in 0.25% of cases. The lab then adds a common cause, such as month-end pressure affecting both officers at once, and shows that combined failure rises sharply. This shows why Greyford schedules a different team for second checks during month-end and does not rely on the arithmetic of independence alone.
Lab — Independent and common-cause failure of checks
# Probability a fraudulent payment change passes all checks (synthetic rates).
p = 0.05
for k in (1, 2, 3): print(f"{k} independent check(s): {p ** k:.4%}")
# Common cause: on 10% of days (month-end), each check fails with 0.35 and failures are shared.
q, pc = 0.10, 0.35
both = (1 - q) * p * p + q * pc * pc
print(f"2 checks with month-end common cause: {both:.2%}")
Run with python3 lab_reliability.py. Verified output:
1 independent check(s): 5.0000%
2 independent check(s): 0.2500%
3 independent check(s): 0.0125%
2 checks with month-end common cause: 1.45%
32.3 Common-cause failures
Common causes include shared pressure, shared misleading information and shared trust in a familiar name. If the fraudulent email convinces the first officer, the second officer may see the same email and be convinced too. Aiko therefore designs the second check to use different information, the supplier file number rather than the email, and a different team. She notes that independence is a design property that must be built, not assumed, and she writes it into the control description so it survives staff changes.
Worked example
Aiko models callback reliability, shows independent checks reduce failure, and designs against common causes.
Synthetic case. Probabilities are synthetic.
Errors and limits
Real failure rates are hard to measure. Independence can erode over time.
Exercises
- EX094 — Two checks. What is the joint failure rate of two independent 5% checks? Rubric: 3 = 0.25%;; 2 = 0.0025;; 1 = 10%;; 0 = none.
- EX095 — Lab common cause. How did a common cause change joint failure? Rubric: 3 = joint failure rose from 0.25% to 1.45%;; 2 = rise;; 1 = vague;; 0 = none.
- EX096 — Building independence. How did Aiko build independence into the second check? Rubric: 3 = different information and a different team;; 2 = different;; 1 = same email;; 0 = none.
Synthesis
Human-dependent controls are reliable only when checks are genuinely independent and common causes are designed out.
Continue studying — chapter 32 of 50
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →