Chapter 2 — Human factors and cyber policy: advanced seminar | Master's Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Human factors and cyber policy: advanced seminar

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Theories of behaviour"]
  N2["2.2 Applying the models"]
  N3["2.3 Critique"]
  N4["2.4 Policy relevance"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Theories of behaviour"]
  N2["2.2 Applying the models"]
  N3["2.3 Critique"]
  N4["2.4 Policy relevance"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Theories of behaviour]
    |
    v
[2.2 Applying the models]
    |
    v
[2.3 Critique]
    |
    v
[2.4 Policy relevance]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) critique key human factors theories; (2) compare behavioural models for security; (3) apply them to the trust's password change.

2.1 Theories of behaviour

In the seminar, Dr Nakamura asks students to compare theories that explain security behaviour. The theory of planned behaviour (Ajzen, 1991) says intentions depend on attitudes, social norms and perceived control. The compliance budget (Beautement, Sasse and Wonham, 2008) says people spend limited effort on security and stop complying when demands exceed it. Sofia notes that the first focuses on what people believe and the second on what demands cost. Both offer predictions about the trust's policy change, which she can compare. She summarises both in a short comparison table.

2.2 Applying the models

Using planned behaviour, Sofia predicts that staff who believe a password manager is easy and see colleagues using it will adopt it. Using the compliance budget, she predicts that removing forced changes frees effort, which may increase compliance with other rules, such as locking screens. The models make different predictions about who changes behaviour: planned behaviour points to attitudes and norms, while the budget points to workload. Her study design can test some of these differences by surveying beliefs and measuring workload. She writes each prediction in one testable sentence.

2.3 Critique

The seminar critiques both. Planned behaviour often explains intentions better than actions, and security actions are frequently habits rather than deliberate choices. The compliance budget is persuasive but hard to measure directly. Bada, Sasse and Nurse (2019) argue that awareness campaigns fail when they assume information alone changes behaviour. Sofia concludes that no single model will explain her results and that she should state which predictions come from which model, so readers can see which theories her data supports and which it does not. The seminar group agrees with this approach.

2.4 Policy relevance

Sofia links theory to policy. If the budget model holds, policy makers should count the cost of each rule and remove low-value ones. If planned behaviour holds, they should focus on making secure options easy and visible. ISO/IEC 27001:2022 requires awareness and competence but leaves the method to organisations. She notes that theory helps policy only when it leads to measurable predictions, and she adds two such predictions to her study plan to test in the trust's data. She notes both predictions in her proposal before seeing any data from after the change.

Worked example

Sofia compares planned behaviour and the compliance budget, derives different predictions for the password change, critiques both and links them to policy.

Synthetic case. Predictions are synthetic; Ajzen (1991), Beautement et al. (2008), Bada et al. (2019) and ISO/IEC 27001:2022 are real.

Errors and limits

Models simplify behaviour. Survey measures of attitudes are imperfect.

Exercises

EX008 — Planned behaviour inputs. What three factors shape intention in planned behaviour? Rubric: 3 = attitudes, social norms and perceived control;; 2 = two;; 1 = vague;; 0 = none.
EX009 — Budget prediction. What does the compliance budget predict after forced changes end? Rubric: 3 = freed effort may raise compliance with other rules;; 2 = freed effort;; 1 = vague;; 0 = none.
EX010 — Intention gap. What is a known weakness of planned behaviour? Rubric: 3 = it explains intentions better than actions;; 2 = intention-action;; 1 = vague;; 0 = none.
EX011 — Campaign failure. Why do campaigns fail according to Bada et al.? Rubric: 3 = they assume information alone changes behaviour;; 2 = information;; 1 = vague;; 0 = none.
EX012 — Theory for policy. When does theory help policy, in Sofia's view? Rubric: 3 = when it yields measurable predictions;; 2 = predictions;; 1 = always;; 0 = none.
EX013 — Two predictions. Name the two model-based predictions she adds. Rubric: 3 = manager adoption by attitudes and norms; better screen locking from freed effort;; 2 = one;; 1 = vague;; 0 = none.
EX014 — Budget measurement. Why is the compliance budget hard to test? Rubric: 3 = it is hard to measure directly;; 2 = measurement;; 1 = vague;; 0 = none.

Synthesis

Behavioural theories are useful when they make distinct, testable predictions about a real policy change.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →