Chapter 8 — Writing about security

Chapter 8 — Writing about security

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Clear writing"]
  N2["8.2 Different readers"]
  N3["8.3 Citing sources"]
  N4["8.4 Avoiding alarmism"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Clear writing"]
  N2["8.2 Different readers"]
  N3["8.3 Citing sources"]
  N4["8.4 Avoiding alarmism"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Clear writing]
    |
    v
[8.2 Different readers]
    |
    v
[8.3 Citing sources]
    |
    v
[8.4 Avoiding alarmism]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) write clear security reports; (2) adapt writing for different readers; (3) cite sources properly.

8.1 Clear writing

Aisha's first assignment is a one-page report on Ashfield's inactive accounts. Dr. Carrow returns her draft marked with questions: what is the problem, why does it matter, what should be done and by whom? She rewrites it with a short summary at the top, the evidence, the risk and a recommendation with an owner. She learns that busy readers often read only the first paragraph, so it must contain the key message. Dr. Carrow gives the rewritten report a strong mark and comments that it can be acted on immediately.

8.2 Different readers

Aisha writes two versions of the same finding. For Ashfield's board, she explains that former employees could still access member records and that the fix is a monthly check linked to leaving procedures. For the IT team, she lists the accounts and the exact steps to disable them. Dr. Carrow notes that the facts are the same, but readers need different detail to act. She checks both versions with a classmate playing each reader, who confirms they know what to do after reading. Dr. Carrow keeps both as examples.

8.3 Citing sources

Aisha learns to cite sources precisely. When she refers to a standard, she names its number, edition and year, such as ISO/IEC 27001:2022. When she cites a paper, she includes authors, year, title and a persistent identifier if one exists. Dr. Carrow warns that standards change, so citing the edition tells readers exactly which version she relied on, and that she should never cite a source she has not checked. She builds a reference list for her journal that includes each source's edition or identifier and the date she checked it.

8.4 Avoiding alarmism

Security writing can slip into alarm. Aisha's draft described an open firewall rule as catastrophic. Dr. Carrow asks what evidence supports that word. She rewrites it to state the rule, what an attacker could do and how likely that is. She learns that measured language builds credibility, and that readers who hear alarm too often stop listening. The revised finding states that the rule allowed connections from any address and that the remote desktop service had been patched recently, which lowers the immediate likelihood but does not remove the need to close it.

Worked example

Aisha rewrites a report with a summary first, produces board and IT versions, cites standards by edition and replaces alarmist language with evidence.

Synthetic case. Reports are synthetic.

Errors and limits

Citing a standard without its edition leaves readers unsure which version applies.

Exercises

• EX022 — Report questions. What four questions should a report answer? Rubric: 3 = problem, importance, action, owner;; 2 = all;; 1 = some;; 0 = none.
• EX023 — Board version. What does the board version emphasise? Rubric: 3 = former employees could access records;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX024 — Edition citation. Why cite a standard's edition? Rubric: 3 = standards change;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 08 (chapter 08 of 40)

← Chapter 07 · Course chapter index · Chapter 09 →

Continue to the next authored lesson.