Chapter 4 — Human factors and cyber policy: guided lab and applied synthesis
Lesson map
Lesson 04 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Reporting route"]
N2["4.2 Guided lab"]
N3["Lab — Reporting times and success in the guided lab"]
N4["4.3 Learning from the test"]
N5["4.4 One-month plan"]
N6["4.5 Synthesis"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Reporting route"]
N2["4.2 Guided lab"]
N3["Lab — Reporting times and success in the guided lab"]
N4["4.3 Learning from the test"]
N5["4.4 One-month plan"]
N6["4.5 Synthesis"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
|
v
[4.1 Reporting route]
|
v
[4.2 Guided lab]
|
v
[Lab — Reporting times and success in the guided lab]
|
v
[4.3 Learning from the test]
|
v
[4.4 One-month plan]
|
v
[4.5 Synthesis]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) test a reporting route with volunteers in a safe setting; (2) measure whether it is quick and clear; (3) write a one-month action plan.
4.1 Reporting route
Riverbend had no clear way to report suspicious messages; people mentioned them to whoever was nearby, if at all. Ruth sets up a simple route: forward anything odd to a shared report address, or tell the duty coordinator, who forwards it. The IT volunteer checks the address daily and replies to every report with a short verdict and thanks. She writes a two-line instruction and adds it to the volunteer guide and to a poster in the warehouse. The route must be quick, because volunteers have little time on shift.
4.2 Guided lab
In the guided lab, Ruth tests the route with eight volunteers using a test email account and synthetic messages. Everyone knows they are testing the route, not being tested. Each volunteer receives three messages, one suspicious, and is asked to report anything odd. Ruth times how long reporting takes and notes confusion. The lab summarises times and success. Seven of eight report the suspicious message correctly; one forwards a genuine message instead, unsure which was odd, which Ruth treats as a useful report rather than a mistake.
Lab — Reporting times and success in the guided lab
# Reporting times (seconds) and success for eight volunteers in the guided lab (synthetic).
times = [25, 31, 34, 38, 42, 47, 95, 110]; correct = [1, 1, 1, 1, 1, 1, 1, 0]
s = sorted(times)
print(f"correct {sum(correct)}/8; median time {(s[3] + s[4]) / 2:.0f} s; over 60 s: {sum(t > 60 for t in times)}")
Run with python3 lab_route.py. Verified output:
correct 7/8; median time 40 s; over 60 s: 2
4.3 Learning from the test
The test shows that forwarding takes most volunteers under a minute, but two struggled to find the report address on their phones. Ruth adds the address as a contact on the shared volunteer phones and asks the IT volunteer to add a quick reply template. Volunteers say they like hearing back, which matches evidence that feedback encourages future reporting. Ruth also notes that one volunteer felt nervous about reporting a genuine message, so she adds a line to the guide: if unsure, report it.
4.4 One-month plan
Ruth writes a one-month action plan. Week one: confirm the callback procedure with the treasurer and second trustee, and send the no-blame message. Week two: replace the shared donations login with individual accounts. Week three: launch the reporting route with the guide and poster. Week four: review reports, replies and any problems with the charity manager. Each step has an owner and a check. Callum notes that a short, concrete plan is more likely to be completed than an ambitious strategy.
4.5 Synthesis
At the end of the course, Ruth summarises what she learned. Security at Riverbend depends on people: volunteers, staff and trustees acting under real pressures. The most useful measures are simple: callbacks for bank changes, individual accounts, an easy reporting route with friendly replies and no blame for honest mistakes. Deceptive tests are unnecessary and could harm trust. She shares her summary with the trustees, who adopt the plan. Callum reminds her to review it after three months, because good habits need regular attention to last.
Worked example
Ruth sets up a reporting route, tests it with eight volunteers, fixes phone contact and unsure-report issues and writes a four-week plan adopted by trustees.
Synthetic case. The lab and plan are synthetic.
Errors and limits
Small test. Plans slip without review.
Exercises
- EX039 — Old reporting. How were suspicious messages reported before? Rubric: 3 = mentioned to whoever was nearby;; 2 = informal;; 1 = button;; 0 = none.
- EX040 — Reply promise. What does the IT volunteer do for every report? Rubric: 3 = replies with a short verdict and thanks;; 2 = feedback;; 1 = vague;; 0 = none.
- EX041 — Lab success. How many volunteers reported the suspicious message correctly in the lab? Rubric: 3 = 7 of 8;; 2 = seven;; 1 = 8 of 8;; 0 = none.
- EX042 — Lab median time. What was the median reporting time in the lab? Rubric: 3 = 40 seconds;; 2 = under a minute;; 1 = vague;; 0 = none.
- EX043 — Genuine forward. How did Ruth treat the volunteer who forwarded a genuine message? Rubric: 3 = as a useful report;; 2 = useful;; 1 = mistake;; 0 = none.
- EX044 — Phone fix. What fixed the phone problem? Rubric: 3 = adding the report address as a contact;; 2 = contact;; 1 = vague;; 0 = none.
- EX045 — Unsure line. What line did Ruth add to the guide? Rubric: 3 = if unsure, report it;; 2 = unsure;; 1 = vague;; 0 = none.
- EX046 — Week two. What happens in week two of the plan? Rubric: 3 = individual accounts replace the shared login;; 2 = accounts;; 1 = vague;; 0 = none.
- EX047 — Week four. What happens in week four? Rubric: 3 = review reports and problems with the manager;; 2 = review;; 1 = vague;; 0 = none.
- EX048 — Plan style. Why prefer a short concrete plan? Rubric: 3 = it is more likely to be completed;; 2 = completion;; 1 = vague;; 0 = none.
- EX049 — Deceptive tests view. What is Ruth's view on deceptive tests? Rubric: 3 = unnecessary and could harm trust;; 2 = unnecessary;; 1 = vague;; 0 = none.
- EX050 — Review timing. When should Ruth review the plan? Rubric: 3 = after three months;; 2 = three months;; 1 = never;; 0 = none.
Synthesis
A safe test, a short plan and simple, kind measures give a small charity a strong start.
Continue studying — chapter 04 of 04
← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →