◇ OpenCyber Academy
Professional · Chapter 5 · English

Chapter 5 — Human factors and cyber policy: tools and interpretation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Human factors and cyber policy: tools and interpretation

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Simple tools"]
  N2["5.2 Interpreting measures"]
  N3["Lab — Median time to verdict before and after templa"]
  N4["5.3 Misleading comparisons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Simple tools"]
  N2["5.2 Interpreting measures"]
  N3["Lab — Median time to verdict before and after templa"]
  N4["5.3 Misleading comparisons"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Simple tools]
    |
    v
[5.2 Interpreting measures]
    |
    v
[Lab — Median time to verdict before and after templa]
    |
    v
[5.3 Misleading comparisons]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) use simple tools to track reports and verdicts; (2) interpret basic measures correctly; (3) avoid misleading comparisons.

5.1 Simple tools

Grace uses a spreadsheet and a short Python script provided by the course to track reports. Each row holds date, team, category, verdict and the time the verdict was sent, with no reporter names. The script computes monthly counts, the share of reports that were malicious and the median time to verdict. She learns to check the script's output against a few rows counted by hand, which builds confidence that the tool is working correctly before she shares figures with managers.

5.2 Interpreting measures

Grace learns to interpret measures carefully. A rise in reports may mean more attacks or more willingness to report; she checks the IT supplier's filter logs to see which. A low share of malicious reports may mean staff report too much, but Alan explains that over-reporting is a healthy sign in a new programme, because it shows people feel safe to ask. The lab computes the median time to verdict before and after replies were templated, showing a large improvement. She records both checks.

Lab — Median time to verdict before and after templates

# Median hours to verdict before and after templated replies (synthetic).
before = [4, 9, 18, 22, 26, 30, 41, 48, 70]; after = [0.5, 1, 1.5, 2, 3, 3.5, 5, 6, 20]
m = lambda x: sorted(x)[len(x) // 2]
print(f"before: median {m(before)} h; after: median {m(after)} h")

Run with python3 lab_verdict.py. Verified output:

before: median 26 h; after: median 3 h

5.3 Misleading comparisons

Grace avoids comparisons that mislead. She does not rank teams by report counts, because team sizes and exposure differ, and rankings would shame some groups. She reports figures only for groups of at least twenty staff. She shows changes over time with the number of cases behind each figure. When a manager asks which team is worst, she explains why that question cannot be answered fairly from the data and offers a more useful question: where do people need more support?

Worked example

Grace tracks reports with a spreadsheet and script, interprets rises and over-reporting correctly and avoids unfair team rankings.

Synthetic case. Data are synthetic.

Errors and limits

Small numbers vary. Scripts need checking after changes.

Exercises

Synthesis

Simple tools give useful measures when interpreted carefully and fairly.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →