◇ OpenCyber Academy
Technical · Chapter 11 · English

Chapter 11 — Human factors and cyber policy: verification

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Human factors and cyber policy: verification

Lesson map

Lesson 11 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Technical checks"]
  N2["11.2 User-side checks"]
  N3["Lab — Verification results for seven controls"]
  N4["11.3 Recording results"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Technical checks"]
  N2["11.2 User-side checks"]
  N3["Lab — Verification results for seven controls"]
  N4["11.3 Recording results"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]

[Learning outcomes]
    |
    v
[11.1 Technical checks]
    |
    v
[11.2 User-side checks]
    |
    v
[Lab — Verification results for seven controls]
    |
    v
[11.3 Recording results]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) verify that controls work as configured; (2) check controls from the user's point of view; (3) record verification results.

11.1 Technical checks

Priya verifies each control. She reports synthetic messages through each route and confirms they arrive in the triage queue within a minute. She submits a synthetic bank detail change and confirms it is held. She checks that external tags appear and that name-match warnings trigger. She checks that seasonal accounts expire on their end date using a test account. Each check has an expected result written before testing, so that she can say clearly whether the control passed or failed. Each check is timed.

11.2 User-side checks

Technical checks do not show what staff experience. Priya asks three volunteers in different roles to use each control while she watches. A driver finds that his phone's messaging app makes forwarding a text awkward, needing five taps. An accounts clerk is unsure what to do when a held change appears. Priya writes a one-line instruction for the clerk and a short guide with pictures for drivers. User-side checks find problems that matter in practice but would not appear in any log.

Lab — Verification results for seven controls

# Verification results for seven controls (synthetic).
r = [("email button", True), ("terminal form", True), ("driver number", False), ("bank change hold", True),
     ("address flag", False), ("external tag", True), ("seasonal expiry", True)]
print("first pass:", sum(ok for _, ok in r), "of", len(r)); print("needed fixes:", [n for n, ok in r if not ok])

Run with python3 lab_verify.py. Verified output:

first pass: 5 of 7
needed fixes: ['driver number', 'address flag']

11.3 Recording results

Priya records each check in a table with date, method, expected result, actual result and any fix. Of seven controls, five pass first time and two need fixes before passing. She shares the table with the IT lead and Tom. The table becomes the baseline for re-verification after future updates. Recording failures as well as passes shows that verification was genuine, and it helps the team notice if the same control fails repeatedly over time. The two fixed controls are the driver number and the address flag.

Worked example

Priya runs technical and user-side checks on seven controls, fixes two and records results.

Synthetic case. Checks are synthetic.

Errors and limits

Checks reflect one moment. Volunteers may not represent everyone.

Exercises

Synthesis

Verification from both technical and user sides, with recorded results, proves controls work.

Continue studying — chapter 11 of 18

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →