Chapter 17 — Human factors and cyber policy: tooling
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Selecting tools"]
N2["17.2 Privacy configuration"]
N3["17.3 Automating triage"]
N4["Lab — Reports needing human review after automation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Selecting tools"]
N2["17.2 Privacy configuration"]
N3["17.3 Automating triage"]
N4["Lab — Reports needing human review after automation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Selecting tools]
|
v
[17.2 Privacy configuration]
|
v
[17.3 Automating triage]
|
v
[Lab — Reports needing human review after automation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) select tools for reporting and triage; (2) configure tools with privacy in mind; (3) automate simple triage steps.
17.1 Selecting tools
Lucas helps Brightwell choose a reporting and triage tool. Options include the email platform's built-in report feature, a separate triage product and a simple shared mailbox with rules. He compares them on cost, ease for staff, effort for the IT contractor and privacy. The built-in feature with a shared mailbox and simple automation meets most needs at low cost. He avoids tools that score individual staff, because the programme is meant to support people, not rank them. The contractor agrees with the choice.
17.2 Privacy configuration
Lucas configures the tool so that reporter identities are visible only to the triage person, for the purpose of sending replies, and are not exported. Reports older than ninety days are deleted automatically. Dashboards show totals by groups of at least twenty staff. He documents these settings with the data protection lead. Privacy by configuration means that good intentions are enforced by the system rather than depending on people remembering rules about what they should not look at. The lead signs off the settings.
17.3 Automating triage
Lucas sets up simple automation: reports of the same email are grouped; a thank-you message is sent immediately; and if the email matches a known malicious sample, a standard verdict is sent and the email is removed from all mailboxes. The IT contractor reviews only new emails. The lab counts how many reports needed human review in a synthetic week. Automation reduces the triage workload and speeds up feedback, which interviews showed staff value highly. Known samples are reviewed weekly to keep the list accurate.
Lab — Reports needing human review after automation
# Reports needing human review after automation in a synthetic week.
reports = 60; duplicates = 38; known = 13
print(f"reports {reports}; grouped duplicates {duplicates}; known-malicious auto verdicts {known}; human review {reports - duplicates - known}")
Run with python3 lab_auto.py. Verified output:
reports 60; grouped duplicates 38; known-malicious auto verdicts 13; human review 9
Worked example
Lucas selects a low-cost built-in tool, configures privacy limits and automates grouping, thanks and known verdicts.
Synthetic case. Tools are generic and data synthetic.
Errors and limits
Automated verdicts can be wrong. Retention limits lose history.
Exercises
- EX049 — Avoided feature. Which tool feature did Lucas avoid? Rubric: 3 = scoring individual staff;; 2 = scoring;; 1 = vague;; 0 = none.
- EX050 — Retention. How long are reports kept? Rubric: 3 = ninety days;; 2 = 90;; 1 = forever;; 0 = none.
- EX051 — Lab review load. How many of 60 reports needed human review in the lab? Rubric: 3 = 9;; 2 = 15%;; 1 = 60;; 0 = none.
Synthesis
Tools should be chosen for ease, configured for privacy and automated to speed feedback.
Continue studying — chapter 17 of 30
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →