Chapter 10 — Human factors and cyber policy: control configuration

Chapter 10 — Human factors and cyber policy: control configuration

Lesson map

Lesson 10 published. Map, example, EX037.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Reporting routes"]
  N2["10.2 Verification controls"]
  N3["10.3 Documentation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX037"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Reporting routes"]
  N2["10.2 Verification controls"]
  N3["10.3 Documentation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]

[Learning outcomes]
    |
    v
[10.1 Reporting routes]
    |
    v
[10.2 Verification controls]
    |
    v
[10.3 Documentation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX037]

Learning outcomes

You will (1) configure reporting routes for email, terminals and phones; (2) set up verification controls for payment and address changes; (3) document configurations clearly.

10.1 Reporting routes

Priya configures three reporting routes. In email, a report button sends the message to the shared IT mailbox and shows a thank-you note at once. On warehouse terminals, the desktop shortcut opens the form labelled Report something odd, which asks for a short description and the terminal number, with no name required. For drivers, a short company number accepts forwarded texts. She tests each route end to end with synthetic messages and confirms that all three arrive in the same triage queue for the IT team.

10.2 Verification controls

Fake requests to change customer delivery addresses or bank details are a major risk at Kestrel. Priya works with the accounts team to configure the accounting system so that any change to bank details is held until a second person confirms it by calling the customer on the number already on file. In the dispatch system, address changes requested by email are flagged for a quick call before the next delivery. These controls move the decision away from judging an email's appearance to a simple check.

10.3 Documentation

Priya documents each configuration on one page: what it does, why it exists, how to test it and who owns it. She includes screenshots and the date of the last test. The IT lead stores the pages in the shared support folder. Clear documentation lets anyone on the team check or repair a control, and it records the reasons for each setting, which prevents someone from removing a control later because they do not understand what it was for. Tom reviews the pages.

Worked example

Priya configures email, terminal and phone reporting routes, sets payment and address verification holds and documents each on one page.

Synthetic case. Configurations are synthetic.

Errors and limits

Holds can delay genuine changes. Phone numbers on file may be outdated.

Exercises

• EX037 — Terminal form. What does the terminal form ask for? Rubric: 3 = a short description and terminal number, no name;; 2 = minimal;; 1 = name;; 0 = none.
• EX038 — Driver route. How do drivers report suspicious texts? Rubric: 3 = forward them to a short company number;; 2 = forward;; 1 = vague;; 0 = none.
• EX039 — Bank change control. How is a bank detail change confirmed? Rubric: 3 = a second person calls the number on file;; 2 = callback;; 1 = email reply;; 0 = none.
• EX040 — Documentation value. Why record the reason for each setting? Rubric: 3 = so nobody removes it without understanding;; 2 = rationale;; 1 = vague;; 0 = none.

Synthesis

Configured routes and holds make reporting easy and verification routine.

Continue studying — chapter 10 of 18

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →