Chapter 4 — Advanced risk and ethics
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Human-centred risk"]
N2["4.2 Ethical issues"]
N3["4.3 Governance"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Human-centred risk"]
N2["4.2 Ethical issues"]
N3["4.3 Governance"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Human-centred risk]
|
v
[4.2 Ethical issues]
|
v
[4.3 Governance]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) assess human-centred risks using SP 800-30r1 concepts; (2) analyse ethical issues in workplace security programmes; (3) set governance for ethical practice.
4.1 Human-centred risk
Daniel assesses risks where human behaviour plays a part, following the concepts in NIST SP 800-30r1: threat sources, events, vulnerabilities, likelihood and impact. For payment fraud, the threat source is criminal groups, the event a fake supplier change request, the vulnerability the absence of independent verification and the impact direct financial loss. He notes that the vulnerability lies in the process, not in staff character. Framing risk this way points to process controls rather than to more warnings for staff. The risk owner agrees.
4.2 Ethical issues
Daniel analyses ethical issues in Calloway's programme. Simulations use deception without specific consent. Department click rankings shame teams publicly. Staff who click repeatedly are sent to mandatory training described as remedial. Some templates mimic bonus announcements. He judges each against principles of respect, proportionality and harm. The bonus template exploits financial hopes and the rankings undermine trust; both could discourage reporting. He also notes that monitoring data about individuals could be misused in performance reviews if not controlled. He discusses each with HR.
4.3 Governance
Daniel proposes governance for ethical practice: a charter stating the purpose of the programme; a review panel including staff representatives and HR to approve simulation templates; a ban on lures exploiting personal distress such as pay, bonuses or health; aggregate reporting only; no use of simulation results in performance reviews; and an annual ethics review. Governance turns good intentions into rules that persist when people change, and it gives staff a voice in a programme that affects them directly. The board adopts it.
Worked example
Daniel frames payment fraud risk in SP 800-30r1 terms, identifies ethical problems in rankings and bonus lures and proposes governance with a review panel.
Synthetic case. Calloway's programme is synthetic; SP 800-30r1 is real.
Errors and limits
Panels can approve borderline content. Ethics reviews may become routine.
Exercises
- EX016 — Fraud vulnerability. Where does the payment fraud vulnerability lie? Rubric: 3 = in the absence of independent verification;; 2 = process;; 1 = staff character;; 0 = none.
- EX017 — Bonus template. Why is the bonus template unethical? Rubric: 3 = it exploits financial hopes;; 2 = distress;; 1 = vague;; 0 = none.
- EX018 — Ranking harm. What harm do department rankings cause? Rubric: 3 = public shaming that undermines trust;; 2 = trust;; 1 = vague;; 0 = none.
- EX019 — Panel members. Who sits on the template review panel? Rubric: 3 = staff representatives and HR;; 2 = representatives;; 1 = vague;; 0 = none.
- EX020 — Performance rule. What rule applies to simulation results and performance reviews? Rubric: 3 = they are never used;; 2 = prohibition;; 1 = vague;; 0 = none.
Synthesis
Human-centred risk points to process controls, and governance makes ethical practice durable.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →