Skip to content
HUMANWALL

Mission 07

The HUMANWALL Concept

A strong human wall is not just trained people. It is people, simple processes and sensible technology working together, with evidence that the agreed steps actually happen and a habit of fixing gaps.

12 minutesCyber DefenderJump to scenario & quiz ↓

In this mission you will

  • Describe the five parts of the HUMANWALL approach: people, process, technology, evidence and improvement.
  • Explain why awareness training alone cannot replace technical controls or clear processes.
  • Map one everyday business risk to a people action, a process action and a technical action.
  • Identify simple evidence that shows an agreed security step is really happening.

From awareness to resilience

In Level 1 you learnt why small businesses are targeted and what they need to protect. Level 2 is about defending. The HUMANWALL idea is simple: no firewall can protect a business if its human wall is weak. But a human wall is not built by telling people to 'be careful'. It is built when people know what to do, the business makes the safe path easy, tools catch what people miss, and someone checks that it all works.

The five layers of a HUMANWALL

  • People: staff can recognise warning signs, pause, verify and report without fear of blame.
  • Process: clear rules for approvals, ownership and escalation. For example, who can change a supplier's bank details and how it is confirmed.
  • Technology: tools that help prevent, detect, contain and recover, such as multi-factor authentication, updates, backups and email filtering.
  • Evidence: simple records that show the agreed steps happened, such as a call-back log, a backup restore test note or an access review sheet.
  • Improvement: a regular habit of looking at near-misses and gaps, then fixing one thing at a time.

Why training alone is not enough

People get tired, busy and distracted. Even a well-trained accountant can click a convincing link at the end of a long GST filing day. That is normal, not a failure of character. Good security assumes people will sometimes make mistakes and adds layers so that one mistake does not become a business crisis. Training raises the chance that someone notices a problem. Process gives them a clear next step. Technology limits the damage when something slips through.

How to apply HUMANWALL to any risk

  1. 1Name the risk in plain words. For example: 'Someone tricks us into paying a fake invoice.'
  2. 2Ask what people should notice and do. For example: pause on any change in bank details and report it.
  3. 3Ask what process makes this reliable. For example: bank detail changes need a call-back to a known number and a second approver.
  4. 4Ask what technology helps. For example: MFA on the email and banking accounts, and limits or alerts on new beneficiaries.
  5. 5Decide what evidence shows it works. For example: a simple log of each call-back with date, who called and who approved.
  6. 6Review it every few months and improve one weak point.

Evidence without paperwork overload

Evidence does not mean audits or thick files. It means being able to answer, honestly, 'How do we know this is happening?' A shared sheet, a dated note or a screenshot of a settings page (with no secrets visible) is often enough for a small team. Remember that completing a course mission, earning XP or a badge shows learning progress only. It does not mean the business is secure, certified or compliant.

Practical business example

Shree Ganesh Packaging adds layers, not lectures

Shree Ganesh Packaging, a fictional 25-person carton maker near Pune, ran a phishing awareness session for all staff. Everyone enjoyed it. Two months later, the accounts assistant Meera received an email that looked like it came from a regular paper supplier, asking that future payments go to a new bank account. She felt something was off, but the owner was travelling and there was no rule about who to ask. She processed it. The payment was caught only because the bank flagged the new beneficiary and called the owner. Afterwards, the owner Rajesh did not blame Meera. Instead the team added a process: any bank detail change needs a call to the supplier's number from the old purchase order, plus approval from a second person. They turned on MFA for the accounts mailbox and kept a one-line log of every call-back in a shared sheet. Every quarter, Rajesh checks the log.

The lesson: Meera's instinct was right, but instinct needs a process to act on. The bank's alert was a technical layer that saved the day. HUMANWALL means building those layers on purpose, not relying on luck.

Key takeaways

  • A human wall is built from five layers: people, process, technology, evidence and improvement.
  • Training improves the chance of noticing a problem, but it does not replace process steps or technical safeguards.
  • For any risk, ask: what should people do, what process makes it reliable, what technology helps, and how will we know it works?
  • Respond to mistakes without blame so that people keep reporting early.
  • Course completion, XP and badges show learning only. They do not mean the business is secure, certified or compliant.

Scenario lab · +25 XP

The trained team and the silent forwarding rule

You manage operations at Navrang Textiles, a fictional 40-person garment exporter in Tiruppur. Staff completed phishing awareness training last quarter. During a routine check, your IT support partner notices that someone's email account has an automatic rule forwarding all invoices to an unknown outside address. Nobody remembers setting it up, and any user can create such rules without review.

Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.

Decision 1 of 3

What is your first response?

Knowledge check · +20 XP on mastery

Check your understanding

1. Does completing this mission prove that your whole organisation is secure?
2. Which of these is a process control rather than a people or technology control?
3. An employee made an honest mistake that led to a near-miss. What response best supports a strong human wall?
4. Which is the best example of evidence that a security step is actually happening?

Practical action · +40 XP (self-reported)

Map one risk to three layers

Choose one risk that would genuinely hurt your business and build a simple HUMANWALL around it. Use general descriptions only. Do not write down passwords, account numbers or customer details.

  1. 1.Write the risk in one plain sentence, for example 'A fake supplier email tricks us into paying the wrong account'.
  2. 2.Note one people action: what should staff notice and do?
  3. 3.Note one process action: what approval, call-back or ownership rule would make the safe action reliable?
  4. 4.Note one technical action: what setting or tool would help prevent, detect or limit the damage?
  5. 5.Decide one simple piece of evidence you could check every month, and who will check it.
  6. 6.Share the one-page map with the owner or manager and agree a date to review it.

Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.

Mission status: Not started

A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.

View my progress