Chapter 5 — Security literacy

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Clinic threats"]
  N2["5.2 Simple controls"]
  N3["5.3 Talking to clinicians"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Clinic threats"]
  N2["5.2 Simple controls"]
  N3["5.3 Talking to clinicians"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Clinic threats]
    |
    v
[5.2 Simple controls]
    |
    v
[5.3 Talking to clinicians]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain common threats to dental clinics; (2) link threats to simple controls; (3) communicate security clearly to clinical staff.

5.1 Clinic threats

Priya learns the threats most relevant to Riverton: phishing emails aimed at reception staff, ransomware that could stop clinics, misdirected patient information, lost laptops and fraud through fake supplier invoices. Healthcare data are valuable and clinics are busy, so mistakes happen under time pressure. She notes that understanding everyday threats helps Riverton spend limited effort on controls that prevent the most common harm rather than rare scenarios. Fake supplier invoices, for example, target the finance process rather than clinicians, so their controls sit elsewhere.

5.2 Simple controls

For each threat Priya lists simple controls: multi-factor authentication for email, offline backups of the practice system and image archive, secure messaging for patient information, laptop encryption and a callback check for changed supplier bank details. She notes that most controls are already available in Riverton's systems but not consistently switched on. She learns that governance often means ensuring existing features are used rather than buying new tools. Turning on the callback check for changed supplier bank details, for instance, needs a procedure, not a purchase.

5.3 Talking to clinicians

Priya prepares a ten-minute talk for clinic staff. She uses examples from dental practice, avoids jargon and explains how each control protects patients. She encourages staff to report mistakes quickly, explaining that a misdirected email reported in minutes can often be recalled. She learns that clinicians respond to patient safety arguments and that respectful, practical messages work better than fear or blame. Framing laptop encryption as protecting patient confidentiality, for example, speaks to what clinicians already care about. She ends the talk by showing staff exactly how to report a mistake.

Worked example

Priya identifies five clinic threats, maps them to existing controls and gives a practical, patient-focused talk.

Synthetic case. Threats and talk are synthetic.

Errors and limits

Talks fade without reinforcement. Features need configuration.

Exercises

• EX013 — Fraud control. Which control addresses fake supplier invoices? Rubric: 3 = callback check for changed bank details;; 2 = callback;; 1 = vague;; 0 = none.
• EX014 — Existing features. What governance gap did Priya find with controls? Rubric: 3 = features available but not consistently switched on;; 2 = unused features;; 1 = vague;; 0 = none.
• EX015 — Clinician argument. Which argument works best with clinicians? Rubric: 3 = patient safety;; 2 = patients;; 1 = fear;; 0 = none.

Synthesis

Security literacy ties common threats to simple, existing controls and respectful communication.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →