◇ OpenCyber Academy
Bachelor's · Chapter 31 · English

Chapter 31 — Advanced cases

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 31 — Advanced cases

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Packet"]
  N2["31.2 Ethics"]
  N3["31.3 Prioritisation"]
  N4["31.4 Communication"]
  N5["31.5 Legal"]
  N6["31.6 Record"]
  N7["31.7 Forward pressure to CISO"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Packet"]
  N2["31.2 Ethics"]
  N3["31.3 Prioritisation"]
  N4["31.4 Communication"]
  N5["31.5 Legal"]
  N6["31.6 Record"]
  N7["31.7 Forward pressure to CISO"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Packet]
    |
    v
[31.2 Ethics]
    |
    v
[31.3 Prioritisation]
    |
    v
[31.4 Communication]
    |
    v
[31.5 Legal]
    |
    v
[31.6 Record]
    |
    v
[31.7 Forward pressure to CISO]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) analyse multi-finding cases; (2) prioritise under board pressure; (3) keep ethics when optics collide.

31.1 Packet

Ranked findings, unfinished retest, board asking to bury F3 before earnings.

The advanced case packet stacks pressure on purpose: a ranked findings list, a retest still open and a board request to bury F3 before an earnings call. Learners must keep the finding visible while drafting management responses that sit beside it, not over it. Sam refuses any edit that deletes F3 from the ranked table. The packet trains resistance with artefacts rather than with slogans. Students leave knowing what a bury request looks like on paper.

31.2 Ethics

Findings stay; management responses allowed beside them.

Ethics here is concrete: the finding remains in the engagement file, and leadership may attach a response explaining timing or compensating controls. Erasure is not a response. Sam teaches the difference between contextualising risk and hiding it. Graded work that soft-deletes F3 fails regardless of eloquence. The rule protects the bank from self-deception more than it protects the tester's ego. A response that argues for delayed patching can still be honest if the finding line itself never moves. Students mark where the response begins so it cannot be mistaken for an edit to the finding.

31.3 Prioritisation

Payment-adjacent and unapproved ledger flows first.

When everything feels urgent, payment-adjacent paths and unapproved ledger flows still go first. Sam's ranking rubric weights blast radius toward money movement and integrity of books. Cosmetic findings wait even if a vice president emails twice. Learners practice saying which item is first and why, in language an executive can hear. Prioritisation without a money lens is theatre at a bank. Ties break toward whichever item still lacks a compensating control in production. The spoken ranking is recorded in the case notes for the debrief.

31.4 Communication

Prepare exec and engineer versions.

One finding needs two reads: an executive version that states decision, date and residual risk, and an engineer version that carries reproduction and fix detail. Sam generates both from the same FindingsDesk fields so severity words cannot drift. Learners who invent a softer executive score fail the consistency check. Translation is not spin. Clear dual versions prevent hallway summaries from rewriting the risk. Both versions carry the same finding identifier so nobody can claim they described different issues. Peer review compares the two pages side by side before anything is mailed.

31.5 Legal

Involve legal if disclosure duties may apply — Sam escalates, does not decide alone.

When a finding might trigger disclosure duties, Sam escalates to legal with facts and does not invent a legal conclusion. Interns and juniors especially must not bargain privately with product managers about silence. The escalation path is written on the method wall. Graded scenarios punish solo bargaining. Legal may still say no duty applies; the point is that Sam is not the one who decides. Escalation notes stick to timestamps, systems touched and data classes involved. If legal asks for more detail, Sam adds evidence paths rather than opinions.

31.6 Record

Keep the bury request in the engagement file.

Pressure emails belong in the file with a factual header, even when the answer is a firm no. Deleting the request protects feelings and destroys history. Sam forwards bury attempts to the CISO alias so the reply becomes institutional memory. Learners practice filing without editorialising. Future ethics classes need artefacts, not legends. Redaction for teaching copies happens later; the engagement file itself stays complete. Headers include the finding id and the time the message arrived.

31.7 Forward pressure to CISO

Pressure emails are forwarded to the CISO alias with a short factual header. Sam does not debate earnings calendars with product managers alone. The alias reply becomes the record.

Debating alone invites a compromise that never reaches governance. The alias forces the conversation into a channel with retention and witnesses. Sam's header states what was asked and what finding it targets, without adjectives. Product managers learn that earnings calendars do not edit ranked tables. The reply, whatever it says, is the artefact the programme later teaches from.

31.8 Escalation SLA

Pressure-to-bury emails get a same-day acknowledgment from the CISO alias even if the full reply waits. Silence looks like assent.

Acknowledgment is not agreement; it is proof the message was seen. Sam tracks median acknowledgment time on his ethics slides because slow silence teaches the wrong lesson. Same-day replies can be short: received, under review, do not alter the finding meanwhile. Full analysis may take longer. Culture dies in the gap where nobody answers. Backup coverage on the alias is staffed whenever the primary is travelling. The acknowledgment template lives next to the other engagement macros.

31.9 Optics versus integrity

Training slides include a past anonymised bury request and the CISO reply supporting the tester. Culture is taught with artefacts.

Slides that only say "act with integrity" lose to a real redacted email thread. Sam's deck shows the ask, the forward and the supporting reply. Students see that refusal can be backed from the top. Optics pressure becomes discussable instead of mythical. Artefacts outlast slogans when the next earnings season arrives. Each term Sam checks that the redactions still hide living people and live tickers. Broken redactions pull the slide from the deck until repaired.

31.10 Printed bury-request thread

The bury-request email and CISO reply are printed (redacted) in ethics class. Students see that refusal is supported. Culture is evidence, not slogans.

Passing the paper around changes the room. People who assumed testers stand alone read a CISO sentence that backs the file. Sam watches posture shift more than he listens to discussion points. Evidence of support is itself a control against future pressure. Classes that only lecture about courage produce quieter courage. Printed copies are collected at the end so uncontrolled scans do not wander. A sign-out sheet records which table held which copy during the exercise.

31.11 Vote then read the reply

Ethics class votes on whether they would have refused; then they read the CISO reply. Most change their vote. Artefacts teach.

The vote comes first so honesty about fear is possible. After the reply is read, many who voted to comply flip, which is the lesson: support was imaginable once they saw it. Sam does not shame the first vote. He wants people to notice how artefacts rewrite what feels possible. Teaching without the second beat would only measure baseline anxiety.

31.12 Ethics folder access logs

Redacted pressure artefacts live in the ethics folder with access logs.

Sensitive teaching material still needs accountability. Access logs show who opened the redacted thread and when. Sam reviews unexpected readers termly with the programme lead. The logs deter gossip packaging and support investigations if something leaks. Transparency about access is part of treating the artefacts with respect. Accounts that only need the lecture slides never receive folder rights. Service accounts used for backup are listed so they do not look like prowlers.

31.13 Termly access review

Ethics folder access logs are reviewed termly for unexpected readers.

A folder without review becomes a rumour mill with a password. Termly checks catch shared credentials and idle curiosity from accounts that should not browse pressure cases. Sam files oddities as process notes, not as public accusations. Most anomalies are boring mistakes; the review still matters. Governance of teaching materials mirrors governance of engagement evidence. Findings from the review feed the next term's access-control checklist. The checklist is short enough that busy leads actually finish it.

31.14 Measure CISO response time

CISO alias response time is measured. Sam's ethics slides include the median response time to pressure emails. Slow silence is tracked as a risk to culture.

What gets measured gets staffed. Publishing the median keeps leadership aware that silence has a cost beyond one awkward email. Sam is careful never to publish contents, only timing. When the median slips, the programme asks for backup coverage on the alias. Culture risk belongs on a dashboard beside technical risk. A rising median triggers a staffing conversation before the next earnings window. The metric resets each quarter so old crises do not hide new delays.

Worked example (synthetic TRB)

Sam refuses to drop F3; offers a management response paragraph; informs supervisor and CISO.

Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.

Errors and limits

This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.

Exercises

Synthesis

Advanced cases test ethics under optical pressure as much as technical skill.

Continue studying — chapter 31 of 40

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →