Chapter 7 — Human factors and cyber policy: controls and verification

Chapter 7 — Human factors and cyber policy: controls and verification

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Phone procedure"]
  N2["7.2 Callback control"]
  N3["7.3 Verification and adjustment"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Phone procedure"]
  N2["7.2 Callback control"]
  N3["7.3 Verification and adjustment"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Phone procedure]
    |
    v
[7.2 Callback control]
    |
    v
[7.3 Verification and adjustment]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) introduce a phone request procedure and contractor callback control; (2) verify that controls work in practice; (3) adjust controls after feedback.

7.1 Phone procedure

Grace writes a procedure for phone requests about tenants: staff never share a tenant's address, contact details or circumstances by phone with anyone other than the verified tenant; requests from relatives, agencies or officials are taken in writing and passed to the data protection lead. A short script helps staff decline politely: I cannot share that by phone, but I can pass your request to our data team. The procedure removes the need to judge whether a caller sounds genuine, which attackers exploit.

7.2 Callback control

With the finance manager, Grace introduces a callback control. Any request to change a contractor's bank details is held until a second person calls the contractor using the number already in Ferngate's records. The finance system blocks payment to new details until the callback is logged. Contractors receive a letter explaining the rule. Cialdini (2021) describes how authority and urgency pressure people; the control means that no single person has to resist that pressure alone under deadline. Most contractors reply positively. Finance agrees.

7.3 Verification and adjustment

Grace verifies both controls. She checks the finance log monthly and confirms that every bank detail change has a callback recorded. She asks five housing officers to practise the phone script in announced role-play with a colleague acting as a caller. All use the script correctly after one practice, but two say the script sounds abrupt to elderly tenants' relatives. Grace adjusts it to add a sentence explaining that the rule protects their family member. Verification and feedback improve controls together.

Worked example

Grace writes a phone request procedure with a script, sets up a contractor callback control and verifies both, adjusting the script after role-play feedback.

Synthetic case. Procedures are synthetic; Cialdini (2021) is real.

Errors and limits

Scripts can sound cold. Contractor records may be outdated.

Exercises

• EX031 — Phone rule. What may staff not share by phone? Rubric: 3 = tenant address, contact details or circumstances;; 2 = tenant data;; 1 = vague;; 0 = none.
• EX032 — Callback number. Which number is used for callbacks? Rubric: 3 = the number in Ferngate's records;; 2 = records;; 1 = request;; 0 = none.
• EX033 — Pressure principles. Which pressures does the callback control relieve? Rubric: 3 = authority and urgency;; 2 = Cialdini;; 1 = vague;; 0 = none.
• EX034 — Role-play. How was the phone script tested? Rubric: 3 = announced role-play with a colleague as caller;; 2 = role-play;; 1 = secret test;; 0 = none.
• EX035 — Script change. Why was the script adjusted? Rubric: 3 = it sounded abrupt to relatives;; 2 = tone;; 1 = vague;; 0 = none.

Synthesis

Controls remove hard judgements, and verification with feedback improves them.

Continue studying — chapter 07 of 12

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →