OpenCyber AcademyLearning outcomes
You will (1) describe the computing systems used in a small healthcare business; (2) identify where staff interact with security; (3) note how workload shapes behaviour.
1.1 Clinic systems
Lucas Ferreira, a technologist student at the fictional Northgate Institute of Technology, starts a placement at the fictional Brightwell Dental Group, with fourteen clinics and 210 staff. Each clinic has reception computers, a practice management system holding patient records, imaging computers and a shared printer. His instructor, Marta Kowalczyk, asks him to list every system and who uses it. Lucas finds that reception staff use four systems during a single appointment booking, switching quickly between screens while talking to patients on the phone or at the desk.
1.2 Security touchpoints
Lucas marks each point where staff meet security: logging in at shift start, locking screens, entering passwords for the imaging system, opening emails from suppliers and patients and handling payment details. Receptionists log in and out many times a day. Adams and Sasse (1999) showed that when security mechanisms conflict with work, users find workarounds. Lucas sees sticky notes with passwords at two clinics and understands them not as carelessness but as a response to too many passwords and too little time between patients.
1.3 Workload and behaviour
During a busy morning, a receptionist handles calls, check-ins and payments with a queue of patients waiting. Lucas notes that security tasks compete with patient care for attention. A screen lock that requires a long password every two minutes is unworkable here. He records his observations as a short report: the number of systems, logins per shift and the main pressure points. This baseline will guide later design choices, because any control must fit the reality of a clinic front desk to be used consistently.
Worked example
Lucas lists clinic systems, maps security touchpoints, explains sticky-note passwords as a workaround and records workload pressure points.
Synthetic case. Brightwell Dental Group is synthetic; Adams and Sasse (1999) is real.
Errors and limits
One morning may not be typical. Observations must respect patient privacy.
Exercises
- EX001 — Systems per booking. How many systems do receptionists use for one booking?
Show marking criteria
Rubric: 3 = four;; 2 = 4;; 1 = one;; 0 = none. - EX002 — Sticky notes. How does Lucas interpret sticky-note passwords?
Show marking criteria
Rubric: 3 = a workaround for too many passwords and little time;; 2 = workaround;; 1 = carelessness;; 0 = none. - EX003 — Competing demand. What do security tasks compete with at reception?
Show marking criteria
Rubric: 3 = patient care;; 2 = patients;; 1 = vague;; 0 = none.
Synthesis
Understanding systems and workload comes before designing any security control.