Design Security for Real Human Systems
Build security that survives deception, pressure, support, recovery, insider authority, poor incentives, and daily work.
Topic index
Human Factors and Security Economics
Learn how usable controls, social engineering, incentives, insiders, support, recovery, biometrics, and behavior shape real security.
Topic index
Understand this domain
Pomerium coverage
Pomerium can provide a consistent identity-aware access path and visible route policy. Organizations still own identity-provider ceremonies, application actions, help-desk recovery, administrator workflow, training, incentives, insider controls, and the consequences imposed on users and operators.
Limits
- People are part of the system design. Calling them the weakest link hides interface, incentive, workload, authority, and recovery defects.
- Awareness can help a person recognize a threat. It cannot make a phishable protocol, unsafe default, or overpowered support account technically safe.
- A control can be effective in a test and fail in practice when the party who pays its cost does not receive its security benefit.
Primary sources
1 learning path
Paths for this topic
4 related guides
Guides in this topic
Analyze Security Incentives
Map cost, benefit, authority, information, liability, and feedback so a control works after teams and vendors optimize their own goals.
Build a Security Behavior Learning Program
Turn role-specific risks into practiced tasks, usable tools, behavior measures, feedback, and control improvements.
Secure Support and Recovery Workflows
Constrain help-desk, authenticator reset, impersonation, exception, federation, and emergency actions as one privileged control plane.
Threat-Model a Human Security Workflow
Model the real people, pressures, interfaces, support paths, incentives, and technical controls around one high-impact security task.
10 related terms
Concepts in this topic
Biometric Authentication
Use noisy, non-secret human characteristics only within a bounded authenticator, sensor, matching, privacy, fallback, and recovery design.
Insider Threat
Reduce harmful action by people or partners who hold legitimate access, knowledge, proximity, or influence, whether intentional or accidental.
Phishing
Distinguish deceptive delivery from verifier impersonation, credential relay, malware, payment fraud, and session theft, then use protocol controls.
Principal-Agent Security Problem
Control delegated security work when the actor has different goals, information, incentives, and accountability from the owner.
Security Awareness and Behavior Change
Build role-specific learning around real tasks, safe alternatives, practice, feedback, and measured behavior instead of annual completion.
Security Incentives and Externalities
Find when the party able to reduce risk does not receive the benefit or bear the loss, then realign cost, authority, and feedback.
Security Support and Recovery Workflow
Treat support, enrollment, authenticator replacement, policy exception, impersonation, and emergency recovery as high-authority security controls.
Social Engineering
Model deception and influence that cause a person or process to disclose information, change identity state, or perform an unauthorized action.
Usable Security
Make the secure action effective, efficient, understandable, accessible, recoverable, and compatible with the person's real task.
Warning Fatigue and Habituation
Prevent repeated low-value prompts and alerts from training people to approve, dismiss, mute, or bypass security decisions.
