Chapter 1 — Human factors and cyber policy: foundations and decisions
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 People and security"]
N2["1.2 Not the enemy"]
N3["1.3 Deception tactics"]
N4["1.4 Knowledge is not enough"]
N5["1.5 Three early decisions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 People and security"]
N2["1.2 Not the enemy"]
N3["1.3 Deception tactics"]
N4["1.4 Knowledge is not enough"]
N5["1.5 Three early decisions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 People and security]
|
v
[1.2 Not the enemy]
|
v
[1.3 Deception tactics]
|
v
[1.4 Knowledge is not enough]
|
v
[1.5 Three early decisions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain why people, not only technology, decide security outcomes; (2) recognise common deception tactics; (3) make three early decisions for a small charity.
1.1 People and security
Ruth Adeyemi coordinates operations at the fictional Riverbend Food Bank, a charity with twelve staff and sixty volunteers. She joins a one-month rapid course at the fictional Oakmere Adult Learning Centre, guided by facilitator Callum Shaw. Callum begins with a simple idea: most attacks on small charities reach people before they reach systems. A fake supplier invoice, a call pretending to be the bank or an email asking a volunteer to log in somewhere all depend on a person acting. Security therefore depends on helping people act safely under ordinary pressures.
1.2 Not the enemy
Callum introduces two classic papers. Adams and Sasse (1999), Users are not the enemy, showed that people break security rules mostly because the rules do not fit their work, not because they are careless. Sasse, Brostoff and Weirich (2001) argued for transforming the so-called weakest link through better design. Ruth recognises this at Riverbend: volunteers share one login for the donations spreadsheet because creating individual accounts was never arranged. The problem is the setup, not the volunteers' attitude, and blaming them would only make them hide mistakes.
1.3 Deception tactics
Ruth learns common tactics described by Hadnagy (2018) and explained by Cialdini's principles of influence. Attackers claim authority, such as posing as the bank or a major donor; create urgency, such as a deadline today; and use liking or familiarity, such as copying a known supplier's style. At Riverbend, a typical attack might be an email from a lookalike of the food wholesaler's address asking for payment to new bank details. Knowing these patterns helps Ruth design simple checks that do not rely on spotting every clue.
1.4 Knowledge is not enough
Callum warns that telling people about tactics rarely changes behaviour by itself. Bada, Sasse and Nurse (2019) found that awareness campaigns often fail when they rely on fear or assume knowledge leads to action. NIST SP 800-50r1 (Hansche et al., 2024) describes learning programmes that combine awareness with role-based training and evaluation. For a small charity, Ruth concludes, the practical approach is a few easy habits, clear procedures for risky tasks and a friendly way to ask for help, rather than long lectures that people forget.
1.5 Three early decisions
Ruth makes three early decisions for Riverbend. First, any change to a supplier's bank details will be checked by phoning the supplier on the number already on file. Second, staff and volunteers will be told clearly that reporting anything odd is welcome and never leads to blame. Third, the shared donations login will be replaced with individual accounts. She writes the decisions in a one-page note for the charity manager, explaining the reason for each in plain language. Callum notes that these decisions target the highest risks with little cost.
Worked example
Ruth learns why people decide outcomes, recognises authority and urgency tactics and makes three decisions: callbacks for bank changes, a no-blame reporting message and individual accounts.
Synthetic case. Riverbend is synthetic; Adams and Sasse (1999), Sasse et al. (2001), Hadnagy (2018), Cialdini (2021), Bada et al. (2019) and SP 800-50r1 are real.
Errors and limits
Decisions need follow-through. Small teams change often.
Exercises
- EX001 — Charity size. How many staff and volunteers does Riverbend have? Rubric: 3 = twelve staff and sixty volunteers;; 2 = 72;; 1 = vague;; 0 = none.
- EX002 — Where attacks land. According to Callum, what do most attacks on small charities reach first? Rubric: 3 = people, before they reach systems;; 2 = people, without the contrast with systems;; 1 = systems;; 0 = none.
- EX003 — Rule breaking cause. Why do people break security rules according to Adams and Sasse (1999)? Rubric: 3 = the rules do not fit their work;; 2 = fit;; 1 = carelessness;; 0 = none.
- EX004 — Shared login cause. Why do volunteers share one donations login? Rubric: 3 = individual accounts were never arranged;; 2 = setup;; 1 = laziness;; 0 = none.
- EX005 — Authority example. Give an example of an authority tactic. Rubric: 3 = posing as the bank or a major donor;; 2 = authority;; 1 = vague;; 0 = none.
- EX006 — Urgency example. Give an example of an urgency tactic. Rubric: 3 = a deadline today;; 2 = deadline;; 1 = vague;; 0 = none.
- EX007 — Typical attack. What typical attack might Riverbend face? Rubric: 3 = a lookalike wholesaler email with new bank details;; 2 = invoice fraud;; 1 = vague;; 0 = none.
- EX008 — Campaign weakness. Why do awareness campaigns often fail according to Bada et al. (2019)? Rubric: 3 = fear and assuming knowledge leads to action;; 2 = fear;; 1 = vague;; 0 = none.
- EX009 — SP 800-50r1 content. What does SP 800-50r1 combine in learning programmes? Rubric: 3 = awareness, role-based training and evaluation;; 2 = three;; 1 = lectures;; 0 = none.
- EX010 — Practical approach. What practical approach suits a small charity? Rubric: 3 = easy habits, clear procedures and friendly help;; 2 = habits;; 1 = long lectures;; 0 = none.
- EX011 — First decision. What is Ruth's first decision? Rubric: 3 = phone suppliers on the number on file before bank changes;; 2 = callback;; 1 = vague;; 0 = none.
- EX012 — Second decision. What is Ruth's second decision? Rubric: 3 = tell everyone reporting is welcome without blame;; 2 = no blame;; 1 = vague;; 0 = none.
- EX013 — Third decision. What is Ruth's third decision? Rubric: 3 = replace the shared login with individual accounts;; 2 = accounts;; 1 = vague;; 0 = none.
Synthesis
Security in small organisations starts with people, simple procedures and a welcoming reporting culture.