Facilitator Notes & Model Answers — Lesson 06
For instructors and self-study · Model classifications, controls, and rationale
Scenario model answers
| Scenario | Type | Controls |
|---|---|---|
| 1 · Quiet download | Possibly malicious (grievance) or coerced; genuinely ambiguous | Detect: access-outside-role & bulk-download monitoring, odd-hours alerts. Limit: least privilege, need-to-know so the reachable set is small |
| 2 · Helpful contractor | Third-party + negligent staffer (two insiders) | Separation of duties (initiate ≠ approve); no credential sharing; contractor access scoped and logged |
| 3 · Pressured colleague | Coerced / compromised — hardest to detect | Dual control on crown jewels; continuous evaluation; above all a blame-free culture so the approach is reported |
Why the poll answer is C (coerced / recruited insider)
- A — visible malcontent: a managed risk; grievance is observable and can be addressed.
- B — careless clicker: exactly what awareness training and technical guard-rails target.
- C — coerced/recruited: motivated to appear normal, holds legitimate access, directed by a capable outsider. Residual risk is highest where intent is hidden and access is genuine.
- D — new hire: higher error rate, but low privilege and heightened supervision cap the risk.
Teaching point: visible risk is managed risk. Design (dual control, continuous evaluation) and culture (safe reporting) are what address the invisible, motivated insider.
Homework — what good looks like
Task 1
Strong answers find a real single-person path to something serious and propose two-person integrity on it, not just "add monitoring."
Task 2
The best answers treat access removal as routine hygiene with an owner and date, recognising movers as the usual sprawl source.
Task 3
Good wording, e.g.: "If anyone ever tries to pressure or bribe you for access, come to me — you'll be supported, not suspected. Reporting it is the right move, every time." Fear-based messaging fails.