Chapter 7 — Human factors and cyber policy: data and telemetry | Technical Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Human factors and cyber policy: data and telemetry

Lesson map

Lesson 07 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Data sources"]
  N2["7.2 Choosing telemetry"]
  N3["7.3 Privacy in telemetry"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Data sources"]
  N2["7.2 Choosing telemetry"]
  N3["7.3 Privacy in telemetry"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX025"]

[Learning outcomes]
    |
    v
[7.1 Data sources]
    |
    v
[7.2 Choosing telemetry]
    |
    v
[7.3 Privacy in telemetry]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) identify data sources for reporting and verification; (2) define what telemetry to collect; (3) respect privacy in telemetry.

7.1 Data sources

Priya lists data sources for monitoring the human side of security at Kestrel: the reporting mailbox export, the mail filter's logs of blocked and delivered malicious messages, the accounting system's log of held payment changes, help desk tickets and short quarterly surveys. Each source answers different questions. Together they show how many attacks reach staff, how many are reported, how quickly IT responds and whether verification controls are being used as intended. She lists each source in a short table. None needs new software.

7.2 Choosing telemetry

Telemetry means data collected automatically from systems. Priya defines a small set: time each malicious message was delivered; time of first report; time of verdict; number of held payment changes and their outcome; and count of badge logins per terminal per shift. She avoids collecting anything not linked to a decision. Collecting too much data adds storage, cost and privacy risk without improving decisions, and it can make staff feel watched. The IT lead agrees with the list. Each item has a stated purpose.

7.3 Privacy in telemetry

Badge login data could show when each person worked, which could be misused to monitor productivity. Priya proposes that badge data be used only for security investigations and aggregated counts, with access limited to IT and a clear statement in the staff privacy notice. Reporting data contain no names. The operations manager agrees in writing. Respecting privacy in telemetry keeps the trust that the reporting programme depends on, and it prevents security data drifting into uses staff never agreed to. Staff are told.

Worked example

Priya lists data sources, defines minimal telemetry and limits badge data use with a written agreement.

Synthetic case. Data uses are synthetic.

Errors and limits

Agreements can be forgotten. Logs may be incomplete.

Exercises

EX025 — Telemetry definition. What is telemetry? Rubric: 3 = data collected automatically from systems;; 2 = automatic;; 1 = surveys;; 0 = none.
EX026 — Collection rule. What rule guides telemetry collection? Rubric: 3 = collect only what links to a decision;; 2 = minimal;; 1 = everything;; 0 = none.
EX027 — Badge data risk. What misuse could badge data allow? Rubric: 3 = monitoring productivity;; 2 = surveillance;; 1 = vague;; 0 = none.
EX028 — Badge data limit. What is badge data limited to? Rubric: 3 = security investigations and aggregated counts;; 2 = limited use;; 1 = vague;; 0 = none.

Synthesis

Minimal telemetry, used only for agreed purposes, supports monitoring without eroding trust.

Continue studying — chapter 07 of 18

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →