Chapter 1 — Security foundations for practitioners

Learning outcomes

You will (1) explain core security ideas in human terms; (2) describe the practitioner's role in human-centred security; (3) set personal learning goals.

1.1 Core ideas

Grace Mwangi, an office manager moving into a security coordinator role, enrols in a six-month professional course at the fictional Harlow Professional Academy. Her mentor, Alan Pryce, starts with core ideas: confidentiality, integrity and availability; threats and vulnerabilities; and controls that reduce risk. He explains each through examples from her employer, the fictional Ferngate Housing Association, which has 180 staff and holds tenant records and rent payments. A fake email that changes a contractor's bank details threatens integrity and money; a lost laptop threatens confidentiality.

1.2 The practitioner's role

Alan explains that Grace's new role sits between staff, managers and the IT supplier. She will help staff report suspicious messages, run short learning sessions, check that verification procedures are followed and report to managers. Adams and Sasse (1999) showed that users are not the enemy, and Sasse, Brostoff and Weirich (2001) argued that the weakest-link view should be transformed by design. Grace's role is to make secure behaviour easy and welcome, not to police colleagues, which suits her background in supporting people.

1.3 Learning goals

Grace sets learning goals: understand common attacks on housing associations, learn simple measurement, write clear procedures and handle ethical questions such as simulations. Alan suggests she keep a portfolio of work, including procedures she writes, data she analyses and reflections on cases. The portfolio will be reviewed in the final chapter. Setting goals early helps her focus during a short course and gives her a way to judge her own progress against concrete outcomes rather than vague impressions. Alan agrees to the goals.

Worked example

Grace learns core security ideas through Ferngate examples, defines her coordinator role as enabling rather than policing and sets learning goals with a portfolio.

Synthetic case. Ferngate is synthetic; Adams and Sasse (1999) and Sasse et al. (2001) are real.

Errors and limits

Roles can drift into enforcement. Goals need revisiting.

Exercises

• EX001 — Integrity example. Which Ferngate example threatens integrity?
  Show marking criteria

  Rubric: 3 = a fake email changing a contractor's bank details;; 2 = bank change;; 1 = lost laptop;; 0 = none.
• EX002 — Role position. Between whom does Grace's role sit?
  Show marking criteria

  Rubric: 3 = staff, managers and the IT supplier;; 2 = three groups;; 1 = vague;; 0 = none.
• EX003 — Role purpose. What is the purpose of Grace's role?
  Show marking criteria

  Rubric: 3 = make secure behaviour easy and welcome;; 2 = enabling;; 1 = policing;; 0 = none.
• EX004 — Weakest link. What did Sasse, Brostoff and Weirich (2001) argue?
  Show marking criteria

  Rubric: 3 = the weakest-link view should be transformed by design;; 2 = design;; 1 = blame;; 0 = none.
• EX005 — Portfolio. What will Grace's portfolio contain?
  Show marking criteria

  Rubric: 3 = procedures, analyses and reflections;; 2 = portfolio;; 1 = vague;; 0 = none.

Synthesis

Practitioners translate security ideas into human terms and enable rather than police.

Continue studying — chapter 01 of 12

← Course home · Course chapter index · Chapter 02 (draft) →