Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 The project"]
  N2["11.2 Outcomes and burden"]
  N3["Lab — Help desk calls before and after keys"]
  N4["11.3 Reporting"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 The project"]
  N2["11.2 Outcomes and burden"]
  N3["Lab — Help desk calls before and after keys"]
  N4["11.3 Reporting"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 The project]
    |
    v
[11.2 Outcomes and burden]
    |
    v
[Lab — Help desk calls before and after keys]
    |
    v
[11.3 Reporting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) carry out an applied project on a human-centred control; (2) evaluate outcomes and burden; (3) report to stakeholders.

11.1 The project

Daniel's applied project introduces phishing-resistant security keys for Calloway's claims and finance staff, 240 people who handle payments and sensitive data. He plans the rollout with IT, HR and team leaders: keys are issued in short sessions, each person registers two keys and a simple recovery process is set up. He applies lessons from earlier chapters: involve users early, test with a pilot team and measure burden. The project aims to make credential phishing ineffective for the most targeted roles. The pilot team gives feedback.

11.2 Outcomes and burden

After four months, Daniel compares credential phishing outcomes and help desk calls. Before keys, these teams had several account compromises from phishing a year; after, none during the period, though the period is short. Help desk calls rose in the first month as people learned the keys and then fell below the previous level, because password resets declined. The lab summarises monthly help desk calls. A short survey shows most staff find keys easier than codes, though some worry about losing them.

Lab — Help desk calls before and after keys

# Monthly help desk calls for 240 staff before and after security keys (synthetic).
base = 45; after = [62, 44, 36, 31]
print("baseline per month:", base)
for m, c in enumerate(after, 1): print(f"month {m}: {c} ({c - base:+d})")

Run with python3 lab_keys.py. Verified output:

baseline per month: 45
month 1: 62 (+17)
month 2: 44 (-1)
month 3: 36 (-9)
month 4: 31 (-14)

11.3 Reporting

Daniel reports to the board and staff. He states that keys removed the main route for credential theft in the targeted teams and reduced password support calls after a learning period. He notes limits: four months is short and attackers may shift to other methods, such as phone-based fraud, which the verification controls address. He recommends extending keys to all staff over the next year. Staff hear the results first, which reinforces that the programme is done with them rather than to them.

Worked example

Daniel rolls out security keys to 240 staff, finds no phishing compromises in four months and lower help desk load after a learning month, and reports honestly.

Synthetic case. The project is synthetic.

Errors and limits

Short periods mislead. Key loss needs good recovery.

Exercises

• EX051 — Target group. Which staff received keys first?
  Show marking criteria

  Rubric: 3 = claims and finance staff, 240 people;; 2 = targeted roles;; 1 = vague;; 0 = none.
• EX052 — Two keys. Why does each person register two keys?
  Show marking criteria

  Rubric: 3 = as a backup if one is lost;; 2 = backup;; 1 = vague;; 0 = none.
• EX053 — Help desk pattern. What did the lab show for help desk calls?
  Show marking criteria

  Rubric: 3 = rose to 62 in month one, then fell to 31 by month four from a base of 45;; 2 = dip;; 1 = vague;; 0 = none.
• EX054 — Attacker shift. What might attackers shift to?
  Show marking criteria

  Rubric: 3 = phone-based fraud;; 2 = phone;; 1 = vague;; 0 = none.
• EX055 — Audience order. Who heard the results first?
  Show marking criteria

  Rubric: 3 = staff, reinforcing that the programme is done with them;; 2 = staff, without explanation;; 1 = the board;; 0 = none.

Synthesis

Applied projects deliver controls with users, measure burden and report limits.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →