Human security: make reporting and verification easy to do

Illustrative case: a changed payment destination

Suppose an accounts-payable employee receives an urgent request to change a supplier's bank details. A familiar name and a real invoice reference make the message plausible. They do not establish permission to change the payment destination. The procedure needs an established supplier contact and approval from a second person, along with a way to handle the exception without delaying every ordinary invoice.

Exercise the procedure using a fictitious supplier and a nonfunctional payment destination. Check whether staff can find the existing contact record, obtain independent confirmation and receive a useful response to their report. If they use a phone number supplied in the incoming message, the request and its confirmation depend on the same source. The exercise should expose that problem before a real payment is involved.

Following the decision through the supporting process

Choose a few consequential decisions for each relevant role. Then follow what the person can actually do: find instructions, verify the request, obtain approval or escalate it. The worksheet records the process supporting the decision, including where that support is missing.

Measure the response loop

Measure how long a report takes to receive acknowledgment and a useful instruction, and how often the reporter receives closure. A report that enters an unmonitored queue gives the organization little chance to act. The route also needs to remain usable when email or the identity provider is unavailable. Test that condition instead of assuming the reporting button will still work.

Give people the procedure and tools they would have during normal work. If they cannot complete the decision, examine the workload, instructions and tool behavior before blaming the individual. A confusing process can produce a poor result even when the person recognizes the concern. A click rate records one behavior in one exercise; it does not measure all of the likelihood or consequences of account misuse.

• Responsible managers and privacy stakeholders should agree on the exercise and its limits.
• An exercise can evaluate the decision without collecting real passwords or unnecessary personal information.
• Aggregate results can support process improvement while limiting unnecessary exposure of individual findings.
• After instructions or tools change, repeating the affected workflow shows whether the change helped.

Insider-risk boundaries

Unusual behavior is a reason to examine context, not enough by itself to establish malicious intent. Define the purpose of insider-risk monitoring and restrict access to its observations. Keep investigation work separate from personnel decisions. CIS Controls address awareness and skills training, and NICE describes relevant work and skills, but fair employment processes still apply. Bring in the appropriate HR, privacy and legal participants when investigating suspected misconduct.