Chapter 11 — Human factors and cyber policy: assets and context | Technologist Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Human factors and cyber policy: assets and context

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Assets"]
  N2["11.2 Decision context"]
  N3["11.3 Prioritising by harm"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Assets"]
  N2["11.2 Decision context"]
  N3["11.3 Prioritising by harm"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Assets]
    |
    v
[11.2 Decision context]
    |
    v
[11.3 Prioritising by harm]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) identify the assets that human-centred controls protect; (2) describe the context in which staff make security decisions; (3) prioritise assets by harm.

11.1 Assets

Lucas lists Brightwell's assets with the practice manager: patient records, payment accounts, the booking system, imaging data and staff accounts. He also lists less obvious assets: the trust of patients, the reputation of each clinic and staff willingness to report problems. That last asset matters because a programme that damages trust can make the organisation less safe overall. Naming trust as an asset reminds managers that how security is done matters as much as what is done. The manager agrees to include trust in the risk register.

11.2 Decision context

Lucas describes the context in which staff make security decisions. Receptionists decide quickly, often while talking to patients. Clinicians are focused on treatment and see email between appointments. Managers deal with suppliers and payments, often near month-end deadlines. Each group faces different pressures and different attacks. He writes a one-paragraph profile for each group, describing typical moments when a deceptive message or call might arrive and what else they are doing at that time, which later guides control design. Staff review the profiles.

11.3 Prioritising by harm

Lucas ranks assets by the harm that would follow from compromise. Patient records come first because of privacy duties and the distress a breach would cause. Payment accounts come second because fraud can cost thousands quickly. Staff accounts come third because they provide routes to the first two. He notes that the payment risk depends almost entirely on one human decision, accepting a changed bank detail, which makes it a priority for a verification procedure rather than for general awareness. Managers agree.

Worked example

Lucas lists assets including trust, profiles decision contexts for three groups and ranks assets by harm.

Synthetic case. Context is synthetic.

Errors and limits

Rankings change as services change. Profiles generalise.

Exercises

EX031 — Hidden asset. Which less obvious asset does Lucas name? Rubric: 3 = staff willingness to report;; 2 = trust;; 1 = vague;; 0 = none.
EX032 — Manager pressure. When do managers face payment pressure? Rubric: 3 = near month-end deadlines;; 2 = month-end;; 1 = vague;; 0 = none.
EX033 — Payment decision. Which single decision drives payment risk? Rubric: 3 = accepting a changed bank detail;; 2 = bank detail;; 1 = vague;; 0 = none.

Synthesis

Assets include trust, and decision contexts reveal where controls are most needed.

Continue studying — chapter 11 of 30

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →