## Chapter 1 — Security foundations for practitioners ### Learning outcomes You will (1) explain core security ideas in human terms; (2) describe the practitioner's role in human-centred security; (3) set personal learning goals. ### 1.1 Core ideas Grace Mwangi, an office manager moving into a security coordinator role, enrols in a six-month professional course at the fictional Harlow Professional Academy. Her mentor, Alan Pryce, starts with core ideas: confidentiality, integrity and availability; threats and vulnerabilities; and controls that reduce risk. He explains each through examples from her employer, the fictional Ferngate Housing Association, which has 180 staff and holds tenant records and rent payments. A fake email that changes a contractor's bank details threatens integrity and money; a lost laptop threatens confidentiality. ### 1.2 The practitioner's role Alan explains that Grace's new role sits between staff, managers and the IT supplier. She will help staff report suspicious messages, run short learning sessions, check that verification procedures are followed and report to managers. Adams and Sasse (1999) showed that users are not the enemy, and Sasse, Brostoff and Weirich (2001) argued that the weakest-link view should be transformed by design. Grace's role is to make secure behaviour easy and welcome, not to police colleagues, which suits her background in supporting people. ### 1.3 Learning goals Grace sets learning goals: understand common attacks on housing associations, learn simple measurement, write clear procedures and handle ethical questions such as simulations. Alan suggests she keep a portfolio of work, including procedures she writes, data she analyses and reflections on cases. The portfolio will be reviewed in the final chapter. Setting goals early helps her focus during a short course and gives her a way to judge her own progress against concrete outcomes rather than vague impressions. Alan agrees to the goals. ### Worked example Grace learns core security ideas through Ferngate examples, defines her coordinator role as enabling rather than policing and sets learning goals with a portfolio. > **Synthetic case.** Ferngate is synthetic; Adams and Sasse (1999) and Sasse et al. (2001) are real. ### Errors and limits Roles can drift into enforcement. Goals need revisiting. ### Exercises - **EX001 — Integrity example.** Which Ferngate example threatens integrity? *Rubric:* 3 = a fake email changing a contractor's bank details;; 2 = bank change;; 1 = lost laptop;; 0 = none. - **EX002 — Role position.** Between whom does Grace's role sit? *Rubric:* 3 = staff, managers and the IT supplier;; 2 = three groups;; 1 = vague;; 0 = none. - **EX003 — Role purpose.** What is the purpose of Grace's role? *Rubric:* 3 = make secure behaviour easy and welcome;; 2 = enabling;; 1 = policing;; 0 = none. - **EX004 — Weakest link.** What did Sasse, Brostoff and Weirich (2001) argue? *Rubric:* 3 = the weakest-link view should be transformed by design;; 2 = design;; 1 = blame;; 0 = none. - **EX005 — Portfolio.** What will Grace's portfolio contain? *Rubric:* 3 = procedures, analyses and reflections;; 2 = portfolio;; 1 = vague;; 0 = none. ### Synthesis Practitioners translate security ideas into human terms and enable rather than police. ### Continue studying — chapter 01 of 12 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** A fake email that changes a contractor's bank details. **EX002.** Between staff, managers and the IT supplier. **EX003.** To make secure behaviour easy and welcome, not to police colleagues. **EX004.** That the weakest-link view should be transformed by designing security around people. **EX005.** Procedures she writes, data she analyses and reflections on cases.