I always considered a checklist, a checklist, so I was interested to learn the distinction between two types of checklists: Read-Do and Do-Confirm.

A Read-Do checklist might be prepared in advance for several potential possibilities. You check off the tasks as you do them, like following a new cooking recipe. They may be geared towards helping people understand what they should be doing and in what order and helping them remember key steps in unusual or unplanned scenarios. So, for example, if a plane develops a particular type of rare fault, such as an engine failure, a Read-Do checklist could be pulled out for that scenario. The pilot and crew can use it to make the most of others' past experiences and failures. Even with training, given the situation's relative rarity, and especially if a serious situation might interfere with normal thinking, a Read-Do checklist helps steer the crew to safe outcomes without relying solely on training and memory. The calm security and simplicity of steps of a checklist can be just what's needed.

A Do-Confirm checklist is more of an aid to memory to make sure nothing gets missed. It's a safety net for normal operation catching lapses in memory. In principle, we know what to do, so we run through those steps from experience and memory and use the Do-Confirm checklist at a designated pause point to ensure we didn't miss anything. The WHO Safe Surgery checklist has helped save 1,000s of lives.

Because a simple checklist can never account for every unexpected occurrence in complex environments—for example, healthcare, aviation, building a skyscraper, or software projects—both checklist types can benefit from items that require a communication step. An item can just be to ensure that all those with the relevant knowledge have discussed things. It's a simple and powerful way to improve outcomes across a wide range of unexpected scenarios.

I learned about the simple power of checklists, the two types, and the resistance to adopting them—from Atul Gawande's, The Checklist Manifesto: How to get Things Right.

Two types of checklists: Read-Do, Do-Confirm

Phishing is tricking people into sharing personal details and logins by pretending to be someone else, and it's surprisingly effective. Some of the smartest people I know have been taken in by it and it only takes a moment’s lapse in concentration or uncertainty to fall for it. The maths is simple: it barely costs anything to send an email to 100,000s of people and it only needs a few people to get caught in the net for it to pay off.

Also, look out for targeted spear-phishing attacks where scammers may seem to know specific details about yourself to make the attack more credible. Or what’s known as whaling — the targeting of high-profile figures such has heads of companies or celebrities with elaborately planned and sometimes very convincing schemes.

You can also check if you’ve been caught in a data breach at: Have I been Pwned.

I updated this image for my book Big Ideas Little Pictures

Types of phishing

In Don Norman’s classic book The Design of Everyday Things, Don gives an example of how to break into an office: just turn up at the door with a bunch of unwieldy computer equipment that looks difficult to carry and ask someone if they can open the door for you. Generally, someone will.

Which goes to show no matter how well your system is designed, how seemingly impregnable your defences are, or how robust your processes, human risk — people doing things they shouldn’t or not doing things they should — are most likely the biggest ones. Like accidentally leaning on the keyboard before sending a bank transfer.

The sketch is loosely based on a story, which is not true but illustrates the point nicely, that the Mongols got past the Great Wall simply by bribing the guards.

If you like behavioural science, cognitive biases and the like, and want to build a better understanding of human risk, take a look at the human risk newsletter run by a long-time patron of Sketchplanations Christian Hunt.

You can listen to a fun, example-packed conversation of human risk in our podcast episode on human risk with Christian Hunt.

Human risk

Two-factor authentication is a neat technique for adding extra security by requiring two different types of verification. So, rather than asking you to provide two passwords—both things you could remember or find written down—if you are asked to provide a password and a code you could only have if you had a particular device, security is greatly enhanced.

The usual factors involved include asking for two from:

Hence the convenience of photo ID where you have to provide the ID and also look like the photo. Or provide a ticket and a code, or a chip and pin…

Also see: choose passwords that make you happy, and 8 character passwords

2 factor authentication

Update: for times when you really need to remember a password I still like this technique, for all other times — which is to say, ideally every time — I suggest using a password manager. Use a password manager to generate unique passwords for every service so long and complex that you couldn't possibly be bothered to type it and that will force you to always use the manager instead.

However, for the few passwords that you can't avoid typing they might as well remind you of something good. I have found this makes me happier.

Choose passwords that make you happy

Which, remarkably, still does not mean they are secure.

Security sketches