Chapter 37 — Human factors and cyber policy: operations | Engineering Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 37 — Human factors and cyber policy: operations

Lesson map

Lesson 37 published. Map, example, EX109.

flowchart TD
  N0["Learning outcomes"]
  N1["37.1 Routine operations"]
  N2["37.2 Ethical simulations in operation"]
  N3["37.3 Complaints and exceptions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX109"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["37.1 Routine operations"]
  N2["37.2 Ethical simulations in operation"]
  N3["37.3 Complaints and exceptions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX109"]

[Learning outcomes]
    |
    v
[37.1 Routine operations]
    |
    v
[37.2 Ethical simulations in operation]
    |
    v
[37.3 Complaints and exceptions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX109]

Learning outcomes

You will (1) define routine operations for the programme; (2) run ethical simulations operationally; (3) handle complaints and exceptions.

37.1 Routine operations

Aiko writes an operations calendar. Each week the triage team reviews clusters and sends feedback. Each month a short refresher goes out and a simulation is run at a planned difficulty. Each quarter the burden survey is sent and measures are reported to the risk committee. Each year the programme is reviewed against its charter. Every task has an owner and a backup. Routine operations matter because awareness work fades without steady attention, as the decay analysis in chapter 6 showed. Backups cover leave and illness.

37.2 Ethical simulations in operation

Simulations run under rules agreed with staff representatives: announced programme, no lures exploiting personal distress such as pay cuts, bonuses or health scares, no use of individual results for discipline, immediate supportive feedback and aggregate reporting only. Each template is rated with the NIST Phish Scale (Dawkins and Jacobs, 2023) and approved by a small panel including a staff representative. Lain, Kostiainen and Čapkun (2022) found that embedded training pages after clicks did not help, so feedback is short and kind rather than a lesson.

37.3 Complaints and exceptions

Some staff complain that simulations feel like being tricked. Aiko answers each complaint personally, explains the rules and records the theme. When several complaints cite one template that mimicked an HR message about leave, the panel withdraws it, accepting that it came too close to personal matters. Exceptions are allowed for staff on sick leave or under stress, who can opt out temporarily through their manager without giving reasons. Handling complaints well keeps the trust on which reporting depends. Themes are reported quarterly.

Worked example

Aiko defines a weekly to yearly operations calendar, runs simulations under agreed ethical rules and withdraws a template after complaints.

Synthetic case. Operations are synthetic; Dawkins and Jacobs (2023) and Lain et al. (2022) are real.

Errors and limits

Opt-outs reduce coverage. Panels may approve borderline lures.

Exercises

EX109 — Banned lures. Which lures are banned? Rubric: 3 = those exploiting personal distress such as pay or health;; 2 = distress;; 1 = vague;; 0 = none.
EX110 — Embedded training. Why is post-click feedback short and kind? Rubric: 3 = Lain et al. found embedded training pages did not help;; 2 = research;; 1 = vague;; 0 = none.
EX111 — Withdrawn template. Why was one template withdrawn? Rubric: 3 = it mimicked an HR leave message too close to personal matters;; 2 = HR;; 1 = vague;; 0 = none.

Synthesis

Operations need a steady calendar, ethical simulation rules and respectful handling of complaints.

Continue studying — chapter 37 of 50

← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →