Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Core ideas"]
N2["1.2 The practitioner's role"]
N3["1.3 Learning goals"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Core ideas"]
N2["1.2 The practitioner's role"]
N3["1.3 Learning goals"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Core ideas]
|
v
[1.2 The practitioner's role]
|
v
[1.3 Learning goals]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain core security ideas in human terms; (2) describe the practitioner's role in human-centred security; (3) set personal learning goals.
1.1 Core ideas
Grace Mwangi, an office manager moving into a security coordinator role, enrols in a six-month professional course at the fictional Harlow Professional Academy. Her mentor, Alan Pryce, starts with core ideas: confidentiality, integrity and availability; threats and vulnerabilities; and controls that reduce risk. He explains each through examples from her employer, the fictional Ferngate Housing Association, which has 180 staff and holds tenant records and rent payments. A fake email that changes a contractor's bank details threatens integrity and money; a lost laptop threatens confidentiality.
1.2 The practitioner's role
Alan explains that Grace's new role sits between staff, managers and the IT supplier. She will help staff report suspicious messages, run short learning sessions, check that verification procedures are followed and report to managers. Adams and Sasse (1999) showed that users are not the enemy, and Sasse, Brostoff and Weirich (2001) argued that the weakest-link view should be transformed by design. Grace's role is to make secure behaviour easy and welcome, not to police colleagues, which suits her background in supporting people.
1.3 Learning goals
Grace sets learning goals: understand common attacks on housing associations, learn simple measurement, write clear procedures and handle ethical questions such as simulations. Alan suggests she keep a portfolio of work, including procedures she writes, data she analyses and reflections on cases. The portfolio will be reviewed in the final chapter. Setting goals early helps her focus during a short course and gives her a way to judge her own progress against concrete outcomes rather than vague impressions. Alan agrees to the goals.
Worked example
Grace learns core security ideas through Ferngate examples, defines her coordinator role as enabling rather than policing and sets learning goals with a portfolio.
Synthetic case. Ferngate is synthetic; Adams and Sasse (1999) and Sasse et al. (2001) are real.
Errors and limits
Roles can drift into enforcement. Goals need revisiting.
Exercises
- EX001 — Integrity example. Which Ferngate example threatens integrity? Rubric: 3 = a fake email changing a contractor's bank details;; 2 = bank change;; 1 = lost laptop;; 0 = none.
- EX002 — Role position. Between whom does Grace's role sit? Rubric: 3 = staff, managers and the IT supplier;; 2 = three groups;; 1 = vague;; 0 = none.
- EX003 — Role purpose. What is the purpose of Grace's role? Rubric: 3 = make secure behaviour easy and welcome;; 2 = enabling;; 1 = policing;; 0 = none.
- EX004 — Weakest link. What did Sasse, Brostoff and Weirich (2001) argue? Rubric: 3 = the weakest-link view should be transformed by design;; 2 = design;; 1 = blame;; 0 = none.
- EX005 — Portfolio. What will Grace's portfolio contain? Rubric: 3 = procedures, analyses and reflections;; 2 = portfolio;; 1 = vague;; 0 = none.
Synthesis
Practitioners translate security ideas into human terms and enable rather than police.