Chapter 8 — Human factors and cyber policy: supervised case analysis
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The near miss"]
N2["8.2 Contributing factors"]
N3["Lab — Contributing factors across four near misses"]
N4["8.3 Recommendations"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The near miss"]
N2["8.2 Contributing factors"]
N3["Lab — Contributing factors across four near misses"]
N4["8.3 Recommendations"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 The near miss]
|
v
[8.2 Contributing factors]
|
v
[Lab — Contributing factors across four near misses]
|
v
[8.3 Recommendations]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) analyse a security near miss without blame; (2) identify contributing factors; (3) recommend improvements under supervision.
8.1 The near miss
A finance assistant received an invoice from a lookalike of a roofing contractor's email address, with new bank details and a request for payment that day because of a supposed cash flow problem. She started to update the details but the finance system blocked payment pending callback. The callback revealed the request was fake. Grace analyses the near miss with Alan's supervision. The assistant had reported it immediately when the callback failed, and she is thanked publicly by the finance manager.
8.2 Contributing factors
Grace identifies factors without blaming the assistant. The lookalike domain passed email checks; the external tag was present but easy to miss on a busy screen; the request used urgency and a plausible story; and month-end workload left little time. The callback control worked as designed. She notes that the assistant behaved reasonably under pressure and that the system caught the fraud, which is exactly how layered defences should work. The lab tallies factors across this and three other near misses that year.
Lab — Contributing factors across four near misses
# Contributing factors across four near misses (synthetic).
nm = [{"urgency", "lookalike domain", "workload"}, {"urgency", "authority"}, {"urgency", "lookalike domain"}, {"urgency", "workload", "authority"}]
for f in ("urgency", "lookalike domain", "workload", "authority"): print(f, sum(f in s for s in nm), "of 4")
Run with python3 lab_nearmiss.py. Verified output:
urgency 4 of 4
lookalike domain 2 of 4
workload 2 of 4
authority 2 of 4
8.3 Recommendations
Grace recommends making the external tag more visible in the finance mailbox, sending contractors a reminder that Ferngate always calls back, and sharing the case anonymously in the next learning session as a success story. Alan reviews the analysis and suggests adding a note on how the callback log helped. Sharing near misses as successes encourages reporting and shows staff that the system is designed to support them. The finance manager approves all recommendations. Work starts the next week. Staff are told.
Worked example
Grace analyses a fake invoice near miss caught by callback, finds factors without blame and recommends visible tags, reminders and sharing the success.
Synthetic case. The case is synthetic.
Errors and limits
Near-miss sets are small. Success stories can encourage complacency.
Exercises
- EX036 — What stopped payment. What stopped the fake payment? Rubric: 3 = the finance system blocked it pending callback;; 2 = callback;; 1 = the assistant;; 0 = none.
- EX037 — Story used. What story did the fake invoice tell? Rubric: 3 = a cash flow problem requiring same-day payment;; 2 = urgency;; 1 = vague;; 0 = none.
- EX038 — Lab top factor. Which factor appeared in all four near misses in the lab? Rubric: 3 = urgency;; 2 = urgency, hedged with workload;; 1 = workload;; 0 = none.
- EX039 — Tag issue. What problem did the external tag have? Rubric: 3 = easy to miss on a busy screen;; 2 = visibility;; 1 = vague;; 0 = none.
- EX040 — Sharing approach. How will the case be shared? Rubric: 3 = anonymously as a success story;; 2 = success;; 1 = blame;; 0 = none.
Synthesis
Blameless analysis shows layered defences working and turns near misses into learning.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →