Chapter 5 — Security literacy

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Why it matters"]
  N2["5.2 Common risks"]
  N3["5.3 Good habits"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Why it matters"]
  N2["5.2 Common risks"]
  N3["5.3 Good habits"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Why it matters]
    |
    v
[5.2 Common risks]
    |
    v
[5.3 Good habits]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain why access control matters in a veterinary group; (2) describe common identity risks; (3) teach basic good habits.

5.1 Why it matters

Fernhill's systems hold client names, addresses and payment details, animal health records, controlled drug records and payroll data. If the wrong person gains access, clients' privacy is harmed, records could be altered and money could be lost. Controlled drug records are subject to strict rules, so their integrity matters legally. Kai explains to staff that access control protects clients, animals and colleagues, not just computers, which helps them see security as part of good clinical and business practice rather than an IT burden.

5.2 Common risks

Kai lists common risks in plain language: passwords reused from personal accounts; fake sign-in emails asking staff to confirm their password; reception workstations left signed in while staff help clients; former staff whose accounts still work; and people with more access than their job needs. Each risk is described from the defender's side, explaining how it is prevented rather than how anyone would exploit it, because staff need practical habits, not knowledge of attack techniques. He asks staff which risks they have seen themselves, which makes the list feel real.

5.3 Good habits

Simple habits address most risks. Use a different password for work, ideally stored in a password manager. Set up multi-factor authentication, preferably a passkey or app rather than text messages. Lock the screen when stepping away, or use quick user switching on shared workstations. Report suspicious emails to IT rather than clicking. Tell IT when someone starts, moves or leaves. Kai turns these into a one-page poster for each clinic's staff room, with pictures and short sentences, reviewed by the practice manager.

Worked example

Kai's poster lists five habits; a quick staff survey afterwards finds most staff already lock screens but few use a password manager.

Synthetic case. The poster and survey are synthetic.

Errors and limits

Teaching staff how attacks work in detail is unnecessary for defenders and unsafe to circulate.

Exercises

• EX013 — Legal integrity. Which records have strict legal integrity rules? Rubric: 3 = controlled drug records;; 2 = drug records;; 1 = emails;; 0 = none.
• EX014 — Reception risk. What is the reception workstation risk? Rubric: 3 = left signed in while staff help clients;; 2 = left open;; 1 = cost;; 0 = none.
• EX015 — Survey gap. What gap did the survey find? Rubric: 3 = few use a password manager;; 2 = password manager;; 1 = screen locks;; 0 = none.

Synthesis

Explaining what access control protects and teaching simple habits makes security part of everyday practice.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →