Chapter 2 — Information security: advanced seminar
Lesson map
Lesson 02 published. Map, example, EX008.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Standards view"]
N2["2.2 Control catalogues and frameworks"]
N3["2.3 Design principles"]
N4["2.4 The seminar argument"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX008"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Standards view"]
N2["2.2 Control catalogues and frameworks"]
N3["2.3 Design principles"]
N4["2.4 The seminar argument"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX008"]
[Learning outcomes]
|
v
[2.1 Standards view]
|
v
[2.2 Control catalogues and frameworks]
|
v
[2.3 Design principles]
|
v
[2.4 The seminar argument]
|
v
[Worked example] --> [Exercise EX008]
Learning outcomes
You will (1) relate awareness training to management standards and control catalogues; (2) connect user behaviour to design principles; (3) build an argument linking intervention to outcome.
2.1 Standards view
In the advanced seminar, Priya maps her topic onto recognised standards. ISO/IEC 27001:2022 requires an organisation running an information security management system to make people aware of the security policy and their contribution to it. ISO/IEC 27002:2022 gives guidance on awareness, education and training as an organisational and people control. ISO/IEC 27000:2026, the current overview of the family, explains how these documents fit together. Priya notes that none prescribes a particular training method, which leaves her question open. She cites each standard by its edition.
2.2 Control catalogues and frameworks
NIST SP 800-53 Revision 5 groups training controls in its awareness and training family, including literacy training that covers recognising phishing. The NIST Cybersecurity Framework 2.0 places awareness and training within its Protect function. Priya observes that catalogues and frameworks describe what an organisation should have, while her study asks which way of delivering it changes behaviour. She records this difference between having a control and the control working, because her dissertation must address the second. Dr. Bello agrees that this distinction gives the dissertation a clear purpose beyond describing existing controls.
2.3 Design principles
Dr. Bello asks the seminar to read Saltzer and Schroeder's 1975 paper, which lists psychological acceptability among its design principles: protection should be easy enough that people apply it routinely and correctly. Priya argues that immediate feedback follows this principle, because it teaches at the moment of error instead of months later. Classmates counter that feedback might also embarrass staff and reduce reporting. She adds reporting rates as a secondary outcome so the study can detect this side effect. The class agrees this addition strengthens the design.
2.4 The seminar argument
Priya presents her argument: just-in-time feedback will reduce clicks because it connects the lesson to a concrete mistake while it is fresh. She states the expected direction and a plausible size, a few percentage points, based on the literature she found. Dr. Bello praises the argument for naming a mechanism and a side effect. He asks her to write down which result would count against her hypothesis before she sees any data, a step she completes in the following chapter. Priya accepts the task.
Worked example
Priya places training within ISO/IEC 27001, ISO/IEC 27002, SP 800-53 and CSF 2.0, links feedback to psychological acceptability and adds reporting as a secondary outcome.
Synthetic case. Standards are paraphrased; consult the editions cited.
Errors and limits
Assuming a control works because a standard requires it confuses having with working.
Exercises
- EX008 — 27001 requirement. What does ISO/IEC 27001:2022 require about people? Rubric: 3 = awareness of policy and their contribution;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX009 — 27000 role. What is ISO/IEC 27000:2026? Rubric: 3 = the overview of the family;; 2 = partly correct;; 1 = vocabulary only;; 0 = none.
- EX010 — SP 800-53 family. Which SP 800-53 family holds training controls? Rubric: 3 = awareness and training;; 2 = partly correct;; 1 = other;; 0 = none.
- EX011 — CSF function. Which CSF 2.0 function includes awareness and training? Rubric: 3 = Protect;; 2 = partly correct;; 1 = other;; 0 = none.
- EX012 — Design principle. Which Saltzer and Schroeder principle supports feedback? Rubric: 3 = psychological acceptability;; 2 = partly correct;; 1 = other;; 0 = none.
- EX013 — Secondary outcome. What secondary outcome is added? Rubric: 3 = reporting rates;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX014 — Expected size. What effect size does Priya expect? Rubric: 3 = a few percentage points;; 2 = partly correct;; 1 = large;; 0 = none.
Continue studying — lesson 02 (chapter 02 of 08)
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.