Zero Security Theatre
Patterns and anti-patterns
Patterns are practices that help when tested. Anti-patterns are common, usually well-intentioned practices that create paperwork without improving the result.
Patterns
Replace remembered behaviour with system behaviour
For each thing staff are asked to remember, look for an arrangement that makes the unsafe action impossible, expensive, or automatically reversible. Keep training for the judgment that genuinely cannot be designed out.
Anti-patterns
Treating training completion as a control
Completion is an attendance record. Where a technical control could prevent or detect the failure, training is a supplement to it, not a substitute for it.