Human factors and cyber policy: foundations and decisions

Learning outcomes

You will (1) explain why people, not only technology, decide security outcomes; (2) recognise common deception tactics; (3) make three early decisions for a small charity.

1.1 People and security

Ruth Adeyemi coordinates operations at the fictional Riverbend Food Bank, a charity with twelve staff and sixty volunteers. She joins a one-month rapid course at the fictional Oakmere Adult Learning Centre, guided by facilitator Callum Shaw. Callum begins with a simple idea: most attacks on small charities reach people before they reach systems. A fake supplier invoice, a call pretending to be the bank or an email asking a volunteer to log in somewhere all depend on a person acting. Security therefore depends on helping people act safely under ordinary pressures.

1.2 Not the enemy

Callum introduces two classic papers. Adams and Sasse (1999), Users are not the enemy, showed that people break security rules mostly because the rules do not fit their work, not because they are careless. Sasse, Brostoff and Weirich (2001) argued for transforming the so-called weakest link through better design. Ruth recognises this at Riverbend: volunteers share one login for the donations spreadsheet because creating individual accounts was never arranged. The problem is the setup, not the volunteers' attitude, and blaming them would only make them hide mistakes.

1.3 Deception tactics

Ruth learns common tactics described by Hadnagy (2018) and explained by Cialdini's principles of influence. Attackers claim authority, such as posing as the bank or a major donor; create urgency, such as a deadline today; and use liking or familiarity, such as copying a known supplier's style. At Riverbend, a typical attack might be an email from a lookalike of the food wholesaler's address asking for payment to new bank details. Knowing these patterns helps Ruth design simple checks that do not rely on spotting every clue.

1.4 Knowledge is not enough

Callum warns that telling people about tactics rarely changes behaviour by itself. Bada, Sasse and Nurse (2019) found that awareness campaigns often fail when they rely on fear or assume knowledge leads to action. NIST SP 800-50r1 (Merritt et al., 2024) describes learning programmes that combine awareness with role-based training and evaluation. For a small charity, Ruth concludes, the practical approach is a few easy habits, clear procedures for risky tasks and a friendly way to ask for help, rather than long lectures that people forget.

1.5 Three early decisions

Ruth makes three early decisions for Riverbend. First, any change to a supplier's bank details will be checked by phoning the supplier on the number already on file. Second, staff and volunteers will be told clearly that reporting anything odd is welcome and never leads to blame. Third, the shared donations login will be replaced with individual accounts. She writes the decisions in a one-page note for the charity manager, explaining the reason for each in plain language. Callum notes that these decisions target the highest risks with little cost.

Worked example

Ruth learns why people decide outcomes, recognises authority and urgency tactics and makes three decisions: callbacks for bank changes, a no-blame reporting message and individual accounts.

Synthetic case. Riverbend is synthetic; Adams and Sasse (1999), Sasse et al. (2001), Hadnagy (2018), Cialdini (2021), Bada et al. (2019) and SP 800-50r1 are real.

Errors and limits

Decisions need follow-through. Small teams change often.

Exercises

• EX001 — Charity size. How many staff and volunteers does Riverbend have?
  Show marking criteria

  Rubric: 3 = twelve staff and sixty volunteers;; 2 = 72;; 1 = vague;; 0 = none.
• EX002 — Where attacks land. According to Callum, what do most attacks on small charities reach first?
  Show marking criteria

  Rubric: 3 = people, before they reach systems;; 2 = people, without the contrast with systems;; 1 = systems;; 0 = none.
• EX003 — Rule breaking cause. Why do people break security rules according to Adams and Sasse (1999)?
  Show marking criteria

  Rubric: 3 = the rules do not fit their work;; 2 = fit;; 1 = carelessness;; 0 = none.
• EX004 — Shared login cause. Why do volunteers share one donations login?
  Show marking criteria

  Rubric: 3 = individual accounts were never arranged;; 2 = setup;; 1 = laziness;; 0 = none.
• EX005 — Authority example. Give an example of an authority tactic.
  Show marking criteria

  Rubric: 3 = posing as the bank or a major donor;; 2 = authority;; 1 = vague;; 0 = none.
• EX006 — Urgency example. Give an example of an urgency tactic.
  Show marking criteria

  Rubric: 3 = a deadline today;; 2 = deadline;; 1 = vague;; 0 = none.
• EX007 — Typical attack. What typical attack might Riverbend face?
  Show marking criteria

  Rubric: 3 = a lookalike wholesaler email with new bank details;; 2 = invoice fraud;; 1 = vague;; 0 = none.
• EX008 — Campaign weakness. Why do awareness campaigns often fail according to Bada et al. (2019)?
  Show marking criteria

  Rubric: 3 = fear and assuming knowledge leads to action;; 2 = fear;; 1 = vague;; 0 = none.
• EX009 — SP 800-50r1 content. What does SP 800-50r1 combine in learning programmes?
  Show marking criteria

  Rubric: 3 = awareness, role-based training and evaluation;; 2 = three;; 1 = lectures;; 0 = none.
• EX010 — Practical approach. What practical approach suits a small charity?
  Show marking criteria

  Rubric: 3 = easy habits, clear procedures and friendly help;; 2 = habits;; 1 = long lectures;; 0 = none.
• EX011 — First decision. What is Ruth's first decision?
  Show marking criteria

  Rubric: 3 = phone suppliers on the number on file before bank changes;; 2 = callback;; 1 = vague;; 0 = none.
• EX012 — Second decision. What is Ruth's second decision?
  Show marking criteria

  Rubric: 3 = tell everyone reporting is welcome without blame;; 2 = no blame;; 1 = vague;; 0 = none.
• EX013 — Third decision. What is Ruth's third decision?
  Show marking criteria

  Rubric: 3 = replace the shared login with individual accounts;; 2 = accounts;; 1 = vague;; 0 = none.

Synthesis

Security in small organisations starts with people, simple procedures and a welcoming reporting culture.

Continue studying — lesson 01 (chapter 01 of 20)

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.