People, Processes & Technology

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 50

The first lesson of the course. Learners work out from a school fire alarm that a tool alone is never enough, sort their ideas into three groups and only then attach the names people, processes and technology. They use the names to diagnose two incidents, the second with weaknesses in all three, then map what an organisation's cybersecurity protects, and finally apply the three elements to a bakery whose oven computer cannot simply be restarted, which is where operational technology is named. The habit to build: when something goes wrong, look for the people, process and technology weaknesses, often more than one, before reaching for a product.

Objectives

• Explain why a security tool on its own is not enough, using an everyday example
• Identify the information, devices, software and networks that cybersecurity protects, and explain how these components work together
• Explain the difference between information technology and operational technology, and why it changes security decisions
• Describe what people, processes and technology each contribute, and spot which one is missing in a scenario

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Have somewhere to write three unlabelled columns for the fire-alarm answers: who acts, what routine, what equipment. Leave them visible; they are labelled in the second step and reused in the fourth.
• Decide whether the “Apply it” questions are done in class or set for another day.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain why a security tool on its own is not enough, using an everyday example
   • Identify the information, devices, software and networks that cybersecurity protects, and explain how these components work together
   • Explain the difference between information technology and operational technology, and why it changes security decisions
   • Describe what people, processes and technology each contribute, and spot which one is missing in a scenario

   Purpose: The first lesson of the course. Learners work out from a school fire alarm that a tool alone is never enough, sort their ideas into three groups and only then attach the names people, processes and technology. They use the names to diagnose two incidents, the second with weaknesses in all three, then map what an organisation's cybersecurity protects, and finally apply the three elements to a bakery whose oven computer cannot simply be restarted, which is where operational technology is named. The habit to build: when something goes wrong, look for the people, process and technology weaknesses, often more than one, before reaching for a product.

2. 1. Is the best alarm enough? Think 6 min

   Purpose: Discover, from a situation everyone knows, that a good tool fails without trained people and a practised routine.

   Ask

   • The school has the best alarm money can buy. Is everyone safe now? What else has to be true?
   • Who checks that everyone is out? How do they know who was in the building?

   Responses to expect

   • “Know where to go”, “fire drills”, “teachers take a register”, “the alarm must work”. Sort each answer into one of the three unlabelled columns: who, what routine, what equipment.

   Misconceptions to challenge

   • A learner may believe: “A better alarm would solve it.” Respond: Ask what a louder alarm does for a pupil who does not know where the assembly point is.

   Discussion pause: Let several learners answer before revealing; the three columns should come from them. Keep the reveal back until the columns are full.

   In the lesson window

   • Think it through: A school installs the best fire alarm available. One afternoon a fire starts in a science lab. What else has to be true for everyone in the building to get out safely?

3. 2. The idea Explain 5 min

   Purpose: Attach the names to the class's own columns, carry them over to an office, use the overlap diagram to show that the elements share work rather than divide it, and show where the fire-alarm comparison stops.

   Ask

   • Which of our three columns goes with each name?
   • Pick one office task. Who does it, what steps do they follow, and what system do they use?
   • Point to the middle of the circles. What would go wrong for the new teacher if one circle were missing?
   • How is an attacker different from a fire?

   Responses to expect

   • The matching is quick; spend the time on the office task. Expect “antivirus” for technology, “staff” for people and some hesitation over process: steer towards “the agreed way something is always done”.
   • Learners sometimes read the circles as three separate jobs. The numbered overlap areas are the point: most real tasks sit in them.
   • The attacker question should bring out that attackers adapt and look for gaps.

   If the explanation does not land: If process stays vague, use a school routine: the register is taken the same way by every teacher, every morning, whoever is covering the lesson.

   In the lesson window

   • Think it through: The three elements of cybersecurity are People, Processes and Technology. Think back to your three fire-alarm groups: who has to act, what routine they follow and what equipment must work. Which element matches each group? How would the three elements work together in an office that depends on computers?

4. 3. How they connect Discover 8 min

   Purpose: Diagnose a failure in which the tool and the training both worked, then see the same kind of email handled with all three elements in place.

   Ask

   • Twelve people reported the email. Why did four days pass before anyone acted?
   • In the worked example, take away one element at a time. What breaks each time?
   • Which element was neglected with the new filter?

   Responses to expect

   • Many learners first blame the four who typed their passwords. Ask what the twelve warnings were for.
   • Some will argue that the training or the filter could also have been better. Agree, then ask which failure the evidence points to most strongly; that is the bridge to the next step.
   • The filter question often draws “technology”; bring it back to what staff were told.

   Misconceptions to challenge

   • A learner may believe: “If anyone falls for a fake email, the training failed.” Respond: No training stops everyone. Ask how the organisation is meant to find out about the ones who do fall for it.

   In the lesson window

   • Think it through: What was the main thing that went wrong?
   • Check your understanding: A new email filter is installed, but staff were never told what it does. They assume it catches every bad email, and stop checking links before they click. Which element was most directly neglected?

5. 4. Tracing a fraud back Think 6 min

   Purpose: Show that a real incident usually has weaknesses in more than one element, and that the elements overlap.

   Ask

   • How many separate weaknesses can you find in the invoice fraud? Which column does each one go in?
   • If the school could fix only one thing by tomorrow, which would you choose, and why?
   • Is missing training a people problem or a process problem?

   Responses to expect

   • Most groups find the untrained finance officer and the missing rule; the absence of an outside-sender warning is the one most often missed.
   • There is no single right answer to the one-fix question. Credit any choice that is justified; the telephone check is the strongest because it works even against a perfect-looking email.

   Misconceptions to challenge

   • A learner may believe: “Each incident has one cause, and the job is to find it.” Respond: Put the three weaknesses in the three columns on the board. Then ask whether removing any one of them on its own would have stopped the payment.
   • A learner may believe: “People are the weakest link, so restrict them more.” Respond: People are also how problems are noticed and reported. Usable controls and clear processes help them do that.

   Discussion pause: Pairs list the weaknesses before the reveal; then take one from each pair until all three columns have an entry.

   In the lesson window

   • Think it through: List every weakness you can find that helped the fraud succeed, and say which element each one belongs to.

6. 5. What cybersecurity protects Predict 7 min

   Purpose: Work out that the record lives on a server, then follow one request through the system diagram to see every part that has to work, and why control of the server bypasses the program's password.

   Ask

   • Where is the record kept, if it can appear on any teacher's screen?
   • Trace the request with your finger on the diagram. What does it pass through on the way there and back?
   • If an attacker controls the server, does the password in the program still protect the records?

   Responses to expect

   • Some say “on the internet” or “in the cloud”. Treat it as a good start: the cloud is someone's servers, and the record still sits on a computer somewhere.
   • Learners usually miss the operating systems. Point out that the workstation and the server each have one.

   Misconceptions to challenge

   • A learner may believe: “Cybersecurity means protecting computers.” Respond: It protects data, applications, operating systems, devices and networks, the people who use them and, in OT, physical processes and safety.
   • A learner may believe: “The password on the program protects the data whatever happens.” Respond: The program and the records are both on the server. Whoever controls the server can go round the program.

   If the explanation does not land: Compare the request to borrowing a book from a library's closed stacks: you ask at the desk, a member of staff checks your card, fetches it from the store and hands you the book. Anyone with a key to the store does not need to ask at the desk.

   In the lesson window

   • Think it through: You can see a pupil’s record on the computer on your desk at school. Does that mean the record is stored on that computer?
   • Check your understanding: The records program at a school is well protected: only staff with the right password can open records in it. An attacker cannot get into the program, but takes control of the server it runs on. Are the records still safe?

7. 6. Two computers in a bakery Predict 8 min

   Purpose: Reason about two computers with the same update and different consequences before IT and OT are named, then use the three elements to plan the harder restart.

   Ask

   • When could each computer safely be restarted? Read the hours again before answering.
   • What does the bakery need from people, from process and from technology between Tuesday and Saturday?

   Responses to expect

   • A few will choose Tuesday evening for both; ask what the ovens are doing at 9 p.m. on a Tuesday.
   • Keep the ICS paragraph brief: the name matters more for later lessons and exam revision than for today.
   • Good plans mention the line supervisors, a safe order for stopping and restarting, a test before baking resumes and some way of keeping the oven computer out of reach until then.

   Misconceptions to challenge

   • A learner may believe: “OT systems should never be updated.” Respond: They are updated, but the update has to be planned around the physical process, and other protections cover the wait.

   Discussion pause: Let groups draft the Saturday plan in the three columns before opening the worked example.

   To go further

   • What could go wrong if the update itself had a fault, and how would the bakery find out before baking resumed?
   • Why might a plant that never stops leave an update waiting for months?

   In the lesson window

   • Think it through: Which plan for the two restarts makes the most sense?
   • Think it through: The oven computer has to wait until Saturday. Using people, processes and technology, what should the bakery put in place for the restart itself, and to protect the oven computer until then?

8. 7. Apply it in a new situation Apply 3 min

   Purpose: Set up independent application in new settings, ideally on a later day.

   Ask

   • Who will try these now, and who will come back to them later in the week?

   Responses to expect

   • The backup question checks diagnosis without any email involved; the dental-practice question checks that learners look for more than one weakness.

   In the lesson window

   • Apply it: A fictional charity’s files are copied to a backup drive automatically every night. The volunteer who set this up left last year. When an attack scrambles the charity’s files, it turns out that the drive has been full since March, and its warning emails have been going to the volunteer’s old address. What most needs to change?
   • Apply it: At a fictional dental practice, a receptionist starts typing “Sam” to email the day’s patient list to the practice manager. The email program suggests a different Sam, a patient, and the list goes to them. The practice has no rule about emailing patient lists, and its staff have had no training on handling them. Which statement is most accurate?

9. 8. Check your understanding Check 4 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare with a neighbour before anyone presses the check button on the shared screen.

   Responses to expect

   • Both should feel straightforward after the lesson; anyone who hesitates on the IT and OT question needs the bakery restart again.
   • These two are approved bank items: a wrong choice is marked only as not the best answer, with no hint, because the bank holds one explanation per question rather than feedback for each option. Talk through the wrong options aloud.

10. 9. What to remember Consolidate 3 min

    Purpose: Summarise the three elements, the overlap between them, what is protected and why OT is different, and link forward to the CIA triad.

    Ask

    • Without looking: what are the three elements, and what does each contribute?
    • Name one incident from today that had more than one weakness.

    Responses to expect

    • People notice and act; processes make action repeatable and owned; technology enforces and supports. The invoice fraud or the dental practice for the second question.

11. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • People, processes and technology share the work, and most of it happens where they overlap.
    • Most incidents have weaknesses in more than one element; find them all before choosing a fix.
    • Cybersecurity protects the data and everything a request for it passes through: applications, operating systems, devices, networks and the people using them.
    • Operational technology controls physical things, so security decisions there can affect safety.

Consolidation

• People, processes and technology share the work, and most of it happens where they overlap.
• Most incidents have weaknesses in more than one element; find them all before choosing a fix.
• Cybersecurity protects the data and everything a request for it passes through: applications, operating systems, devices, networks and the people using them.
• Operational technology controls physical things, so security decisions there can affect safety.