Chapter 33 — Human factors and cyber policy: safety and resilience | Engineering Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 33 published. Map, example, EX097.

flowchart TD
  N0["Learning outcomes"]
  N1["33.1 Safety links"]
  N2["33.2 Designing for deception"]
  N3["33.3 Rehearsing recovery"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX097"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["33.1 Safety links"]
  N2["33.2 Designing for deception"]
  N3["33.3 Rehearsing recovery"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX097"]

[Learning outcomes]
    |
    v
[33.1 Safety links]
    |
    v
[33.2 Designing for deception]
    |
    v
[33.3 Rehearsing recovery]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX097]

Learning outcomes

You will (1) connect security behaviour to safety at a water utility; (2) design resilience for when people are deceived; (3) rehearse recovery without deception.

33.1 Safety links

At a water utility, a deceived operator could allow changes to treatment settings that affect public health. Aiko works with the safety manager to link security and safety procedures. Any change to dosing settings already requires a second engineer for safety reasons; she extends that rule to remote requests, so a deceived operator alone cannot change a setting. The safety case now lists social engineering as a possible initiating event, with controls and response actions, so security and safety teams share one view of the hazard.

33.2 Designing for deception

Aiko assumes that someone will eventually be deceived, because no programme can prevent all deception. She designs resilience: automatic alerts on unusual settings changes, a clear way to raise concern after the fact without blame, and a quick route to reverse changes. Staff are told that reporting a mistake quickly is the most valuable thing they can do. This shifts the question from whether people can be fooled to how fast the organisation recovers when they are, which is a more achievable goal.

33.3 Rehearsing recovery

Greyford rehearses recovery through tabletop exercises, in which staff talk through a scenario such as a vendor impersonation that has led to a session opening. Exercises are announced, run with willing participants and focused on the response, not on catching anyone out. The first exercise reveals that the control room does not know who to call out of hours in the security team. A rota is published the next week. Rehearsing recovery openly builds confidence rather than fear, consistent with the ethical approach of the programme.

Worked example

Aiko links security to dosing safety rules, designs for recovery after deception and runs announced tabletop exercises.

Synthetic case. Scenarios are synthetic.

Errors and limits

Tabletop exercises may miss practical problems. Alerts may be ignored.

Exercises

EX097 — Safety rule extension. Which safety rule was extended to remote requests?
Show marking criteria
Rubric: 3 = second engineer for dosing changes;; 2 = two-person;; 1 = vague;; 0 = none.
EX098 — Resilience aim. What question does designing for deception shift to?
Show marking criteria
Rubric: 3 = how fast the organisation recovers;; 2 = recovery;; 1 = whether people are fooled;; 0 = none.
EX099 — Tabletop finding. What gap did the first tabletop reveal?
Show marking criteria
Rubric: 3 = no out-of-hours security contact known;; 2 = rota;; 1 = vague;; 0 = none.

Synthesis

Security and safety share hazards, and resilience assumes deception will happen and rehearses recovery openly.

Continue studying — chapter 33 of 50

← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →