Human-Risk Defense: Build Better Defaults

Security awareness matters, but awareness alone is a weak architecture.

If one distracted click can expose an entire organization, the problem is not only the person who clicked.

The system gave one human decision too much power.

This lesson focuses on defenses that make safe behavior easier and unsafe behavior less damaging.

Start with the failure condition

Consider this statement:

Students keep responding to fake support messages.

Weak control:

Tell students to be more careful.

Stronger design asks:

• How do legitimate support messages normally arrive?
• Can students verify support through a known channel?
• Would support ever ask for a password or MFA code?
• Can suspicious messages be reported easily?
• Does the account use MFA?
• Are high-risk actions logged?
• Can one student account change critical settings?

Awareness becomes one layer in a larger control system.

Policy should reduce ambiguity

A useful policy answers questions before pressure arrives.

For example:

School or course support will never ask students to send passwords or one-time authentication codes through email, chat, or phone. Students should verify unusual account requests through the approved support channel.

That policy does more than say "watch for scams." It creates a predictable rule that makes an attacker story easier to reject.

Clean desk, clean screen, clean evidence

The Garden State Cyber curriculum includes human-risk practices such as clean-desk awareness.

The idea is broader than keeping a desk tidy.

Information can leak through:

• passwords on sticky notes
• unlocked screens
• printed schedules
• student names on open documents
• badges
• discarded drafts
• whiteboards
• screenshots

A clean-desk or clean-screen policy should protect useful information without creating unreasonable classroom rules.

Classroom walk-through

Use a teacher-provided fictional image, diagram, or staged classroom scene.

Identify at least eight information exposures.

For each exposure, record:

Do not count decorative clutter unless it creates a real information or access risk.

Build a human-risk control stack

Choose one scenario:

Scenario A: fake help-desk call

Scenario B: suspicious software download

Scenario C: tailgating through a secured door

Scenario D: sensitive screenshot shared publicly

Design five controls using different categories:

1. policy
2. technical control
3. user-interface or process design
4. monitoring or reporting
5. recovery or response

Example for a fake support call:

• policy: support never requests MFA codes
• technical: MFA protects the account if a password is exposed
• process: users can call the known support number
• monitoring: unusual sign-ins trigger alerts
• response: revoke sessions and reset credentials through the approved process

Each control has a different job.

Measure whether training works

"We gave a presentation" is not evidence that awareness improved.

Think about observable outcomes:

• students correctly identify verification channels
• suspicious messages are reported more quickly
• fewer people share authentication codes in simulations
• users can explain why a request is risky
• reporting rates increase without punishment for honest mistakes

The goal is not to trick students and celebrate failures.

The goal is to improve the system's ability to resist and recover from deception.

Design an awareness exercise

Create a short ethical social-engineering simulation plan using only fictional or opt-in classroom material.

Your plan must include:

Learning objective

What should students learn?

Synthetic artifact

What fake message, call transcript, or scenario will they analyze?

Boundary

Who is involved, and what real systems are excluded?

Success criteria

What behavior shows understanding?

Debrief

How will students learn from the exercise?

No-surprise rule

Explain how the activity avoids embarrassing, targeting, or secretly collecting information from students.

Do not design a real phishing campaign against classmates.

Reporting culture

A security program becomes weaker if people hide mistakes because they expect punishment or ridicule.

Suppose a student clicked a suspicious link and immediately reports it.

A productive response is:

1. protect the account or device
2. preserve useful evidence
3. determine what happened
4. improve the process

Blame-first responses encourage silence.

Fast reporting can reduce impact.

Build a one-page Human-Risk Playbook

Your playbook must include:

• three verification rules
• three things legitimate support will never request
• suspicious-message reporting path
• clean-desk / clean-screen practices
• what to do after an accidental click or disclosure
• one technical control that limits impact
• one sentence explaining why reporting mistakes quickly matters

Evidence for Lesson 3

Submit:

• classroom exposure table
• five-control human-risk stack
• ethical awareness exercise plan
• Human-Risk Playbook

Finish with:

The human-risk control I trust most is not "be careful." It is ________ because ________.

Good security does not require people to make the perfect decision every time. It gives them clear rules, safer defaults, easy verification, and a way to recover when something still goes wrong.