I always considered a checklist, a checklist, so I was interested to learn the distinction between two types of checklists: Read-Do and Do-Confirm.

A Read-Do checklist might be prepared in advance for several potential possibilities. You check off the tasks as you do them, like following a new cooking recipe. They may be geared towards helping people understand what they should be doing and in what order and helping them remember key steps in unusual or unplanned scenarios. So, for example, if a plane develops a particular type of rare fault, such as an engine failure, a Read-Do checklist could be pulled out for that scenario. The pilot and crew can use it to make the most of others' past experiences and failures. Even with training, given the situation's relative rarity, and especially if a serious situation might interfere with normal thinking, a Read-Do checklist helps steer the crew to safe outcomes without relying solely on training and memory. The calm security and simplicity of steps of a checklist can be just what's needed.

A Do-Confirm checklist is more of an aid to memory to make sure nothing gets missed. It's a safety net for normal operation catching lapses in memory. In principle, we know what to do, so we run through those steps from experience and memory and use the Do-Confirm checklist at a designated pause point to ensure we didn't miss anything. The WHO Safe Surgery checklist has helped save 1,000s of lives.

Because a simple checklist can never account for every unexpected occurrence in complex environments—for example, healthcare, aviation, building a skyscraper, or software projects—both checklist types can benefit from items that require a communication step. An item can just be to ensure that all those with the relevant knowledge have discussed things. It's a simple and powerful way to improve outcomes across a wide range of unexpected scenarios.

I learned about the simple power of checklists, the two types, and the resistance to adopting them—from Atul Gawande's, The Checklist Manifesto: How to get Things Right.

Two types of checklists: Read-Do, Do-Confirm

Phishing is tricking people into sharing personal details and logins by pretending to be someone else, and it's surprisingly effective. Some of the smartest people I know have been taken in by it and it only takes a moment’s lapse in concentration or uncertainty to fall for it. The maths is simple: it barely costs anything to send an email to 100,000s of people and it only needs a few people to get caught in the net for it to pay off.

Also, look out for targeted spear-phishing attacks where scammers may seem to know specific details about yourself to make the attack more credible. Or what’s known as whaling — the targeting of high-profile figures such has heads of companies or celebrities with elaborately planned and sometimes very convincing schemes.

You can also check if you’ve been caught in a data breach at: Have I been Pwned.

I updated this image for my book Big Ideas Little Pictures. Here's the original

Types of phishing

Two-factor authentication is a neat technique for adding extra security by requiring two different types of verification. So, rather than asking you to provide two passwords—both things you could remember or find written down—if you are asked to provide a password and a code you could only have if you had a particular device, security is greatly enhanced.

The usual factors involved include asking for two from:

Hence the convenience of photo ID where you have to provide the ID and also look like the photo. Or provide a ticket and a code, or a chip and pin…

Also see: choose passwords that make you happy, and 8 character passwords

2 factor authentication

Update: for times when you really need to remember a password I still like this technique, for all other times — which is to say, ideally every time — I suggest using a password manager. Use a password manager to generate unique passwords for every service so long and complex that you couldn't possibly be bothered to type it and that will force you to always use the manager instead.

However, for the few passwords that you can't avoid typing they might as well remind you of something good. I have found this makes me happier.

Choose passwords that make you happy

Which, remarkably, still does not mean they are secure.

Get my new weekly sketch in your inbox

Category: security