Chapter 10 — Human factors and cyber policy: orientation | Technologist Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Human factors and cyber policy: orientation

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Scope"]
  N2["10.2 Policy shapes behaviour"]
  N3["10.3 Brightwell's policies"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Scope"]
  N2["10.2 Policy shapes behaviour"]
  N3["10.3 Brightwell's policies"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Scope]
    |
    v
[10.2 Policy shapes behaviour]
    |
    v
[10.3 Brightwell's policies]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) describe the scope of human factors and cyber policy; (2) explain how policy shapes behaviour; (3) outline Brightwell's current policies.

10.1 Scope

Human factors and cyber policy covers how people interact with security systems and how rules, culture and design shape that interaction. Sasse, Brostoff and Weirich (2001) argued for transforming the weakest link by designing security around human capabilities. Lucas learns that the field includes usability, training, culture, ethics and organisational policy. At Brightwell, this means looking at how receptionists, clinicians and managers experience security and what policies ask of them. He reads the paper and summarises its main argument for the practice manager in plain words.

10.2 Policy shapes behaviour

A policy states what people must do. Brightwell's policy requires password changes every month and forbids writing passwords down. Lucas finds that monthly changes push staff to write passwords on notes, breaking the second rule. Policy that ignores human memory creates the behaviour it forbids. He also finds that the policy says staff must report incidents but does not say how, which leaves people uncertain. Good policy is specific, practical and consistent with how people work. He notes both problems in his report.

10.3 Brightwell's policies

Lucas reviews Brightwell's policies: acceptable use, passwords, data protection and incident reporting. He lists problems: outdated password rules, no reporting instructions, no procedure for verifying vendor calls and no statement that reporting mistakes is welcome. He drafts a short list of proposed changes for the practice manager, written in plain language. This orientation sets the agenda for the human factors chapters that follow, which will design and test each improvement. The practice manager agrees to review the list with the clinic leads at their next meeting.

Worked example

Lucas defines the field, shows how monthly password changes cause written passwords and lists policy gaps at Brightwell.

Synthetic case. Policies are synthetic; Sasse et al. (2001) is real.

Errors and limits

Policy change needs approval. Plain language can lose precision.

Exercises

EX028 — Policy conflict. Which two policy rules conflict? Rubric: 3 = monthly changes and no writing down;; 2 = conflict;; 1 = vague;; 0 = none.
EX029 — Reporting gap. What is missing from the reporting policy? Rubric: 3 = how to report;; 2 = method;; 1 = vague;; 0 = none.
EX030 — Missing statement. Which welcoming statement is missing? Rubric: 3 = that reporting mistakes is welcome;; 2 = no-blame;; 1 = vague;; 0 = none.

Synthesis

Policy shapes behaviour, and policies that ignore people create the behaviour they forbid.

Continue studying — chapter 10 of 30

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →