Chapter 2 — Human factors and cyber policy: current practice

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Current practice"]
  N2["2.2 Guidance"]
  N3["2.3 Gaps"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Current practice"]
  N2["2.2 Guidance"]
  N3["2.3 Gaps"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Current practice]
    |
    v
[2.2 Guidance]
    |
    v
[2.3 Gaps]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) describe current practice in security awareness programmes; (2) relate practice to guidance such as NIST SP 800-50r1; (3) identify gaps between practice and evidence.

2.1 Current practice

Daniel surveys current practice through industry reports and conversations with peers. Many organisations run annual online courses, monthly simulated phishing and dashboards of click rates by department. Fewer measure reporting speed or invest in verification procedures for high-risk tasks. The Verizon DBIR continues to report a large human element in breaches, which organisations often cite to justify training. Daniel notes that practice is shaped as much by what is easy to buy and report as by what evidence shows works. He records each source.

2.2 Guidance

NIST SP 800-50r1 (Hansche et al., 2024) describes building a cybersecurity and privacy learning programme, including assessing needs, designing role-based content, implementing, and evaluating. The older SP 800-16 (Wilson et al., 1998) set out the distinction between awareness, training and education. The ENISA cybersecurity culture guidelines stress understanding and shaping culture rather than delivering messages alone. Daniel maps Calloway's programme against these documents and finds that needs assessment and evaluation are weakest, while content delivery is strongest. He shares the mapping with the risk committee so that members can see where effort is concentrated and where the programme needs to grow next.

2.3 Gaps

Comparing practice with evidence, Daniel finds gaps. Lain, Kostiainen and Čapkun (2022) found that embedded training after simulated clicks did not reduce later clicks, yet Calloway uses exactly that. Bada, Sasse and Nurse (2019) found fear-based messages often backfire, yet Calloway's posters use alarming images. Reporting, which Lain and colleagues found valuable at scale, is hard at Calloway because the report address is buried. Identifying these gaps gives Daniel a starting agenda grounded in published evidence rather than personal preference. He lists each gap with its source.

Worked example

Daniel reviews common practice, maps Calloway against SP 800-50r1, SP 800-16 and ENISA guidance and identifies three gaps against evidence.

Synthetic case. Calloway is synthetic; the cited guidance and studies are real.

Errors and limits

Peer conversations are anecdotal. Guidance is not evidence of effect.

Exercises

• EX006 — Common practice. Which measure dominates common practice?
  Show marking criteria

  Rubric: 3 = click rates by department;; 2 = clicks;; 1 = reporting speed;; 0 = none.
• EX007 — Weakest stages. Which programme stages were weakest at Calloway?
  Show marking criteria

  Rubric: 3 = needs assessment and evaluation;; 2 = two;; 1 = delivery;; 0 = none.
• EX008 — Embedded training gap. What evidence conflicts with Calloway's embedded training?
  Show marking criteria

  Rubric: 3 = Lain et al. found it did not reduce clicks;; 2 = Lain;; 1 = vague;; 0 = none.
• EX009 — Poster gap. Which practice conflicts with Bada et al. (2019)?
  Show marking criteria

  Rubric: 3 = alarming fear-based posters;; 2 = fear;; 1 = vague;; 0 = none.
• EX010 — Reporting gap. Why is reporting weak at Calloway?
  Show marking criteria

  Rubric: 3 = the report address is buried;; 2 = access;; 1 = vague;; 0 = none.

Synthesis

Current practice often lags evidence, and guidance helps map the gaps.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →