◇ OpenCyber Academy
Bachelor's · Chapter 32 · English

Chapter 32 — Interdisciplinary interfaces

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 32 — Interdisciplinary interfaces

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes"]
  N1["32.1 Legal"]
  N2["32.2 HR"]
  N3["32.3 SOC"]
  N4["32.4 Developers"]
  N5["32.5 Executives"]
  N6["32.6 Friction"]
  N7["32.7 Generated translation packets"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["32.1 Legal"]
  N2["32.2 HR"]
  N3["32.3 SOC"]
  N4["32.4 Developers"]
  N5["32.5 Executives"]
  N6["32.6 Friction"]
  N7["32.7 Generated translation packets"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX094"]

[Learning outcomes]
    |
    v
[32.1 Legal]
    |
    v
[32.2 HR]
    |
    v
[32.3 SOC]
    |
    v
[32.4 Developers]
    |
    v
[32.5 Executives]
    |
    v
[32.6 Friction]
    |
    v
[32.7 Generated translation packets]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes

You will (1) work with legal, HR, SOC and developers; (2) translate findings; (3) respect other professions' constraints.

32.1 Legal

Contracts, disclosure, privacy — Sam brings facts, not legal conclusions.

Legal partners need a clean factual packet: systems touched, data classes, timestamps and whether customer data left the bank. Sam refuses to draft conclusions about breach notification statutes; that is counsel's lane. The interface works when red teamers speak precisely and stay inside evidence. Vague adjectives force lawyers to re-investigate what the tester already knew. A one-page fact sheet attached to the ticket beats a long narrative email. Fact sheets travel better across counsel rotations than heroic memory does.

32.2 HR

Staff-affecting simulations need HR paths.

Phishing or social exercises that can touch staff records or performance perceptions require an HR path before launch. Sam's checklist asks who will see names, how long identifiers live and how complaints will be handled. Skipping HR once created a grievance that outlived the finding. The path is a named contact and a written consent boundary, not a friendly hallway nod. Findings that implicate a person's conduct go through HR language review before wide distribution. People-impacting work without an HR path is treated as a scope defect.

32.3 SOC

Detection engineering consumes ATT&CK tags and timelines.

SOC engineers can use red-team output only when technique tags and stage times are present. Sam's chain diagrams feed detection backlog items with those fields already filled. A screenshot without a technique id is a story; a tagged timeline is a work order. Purple synergy fails when red teamers dump lore and expect analysts to invent structure. PulseMap imports are rejected if required tags are blank. Tagged timelines are how detection work begins rather than how arguments begin.

32.4 Developers

Want reproduction and safe fix patterns.

Developers ask for exact reproduction steps and a fix pattern that will not brick payments. Sam includes a minimal request, expected response and a suggested guard that stays inside the service's change rules. Heroic exploit write-ups without a safe patch shape waste engineering sprints. FindingsDesk templates force a reproduction block before a finding can leave draft. When a fix is unclear, Sam schedules a fifteen-minute huddle rather than guessing in prose. Reproducible steps are the courtesy developers remember next quarter.

32.5 Executives

Want decisions and dates.

Executives need the decision required, the date it is needed and the residual if they wait. Sam keeps executive notes under half a page and links deeper detail rather than pasting it. Metaphor-heavy briefings lose to a table with three rows. The interface fails when testers perform expertise instead of enabling a choice. Every executive note ends with a single asked decision in plain text, and dates are calendar dates. A crisp ask is kinder than a brilliant digression when calendars are full.

32.6 Friction

Procurement and change windows are real; plan for them.

Brilliant findings die when the fix needs a vendor change during a freeze. Sam asks early which remedies require procurement or a change window and records those constraints beside the finding. Planning for friction is not lowering severity; it is sequencing work the bank can actually do. Engagement kickoffs include a five-minute constraint scan with the owner. Surprise freezes still happen; documented constraints make rescheduling calmer. Calendar literacy is part of technical maturity in regulated firms.

32.7 Generated translation packets

Translation packets are generated from FindingsDesk fields so exec and engineer texts cannot disagree on CVSS-like scores or asset ids. Sam once found a drift of severity words between emails; templates removed it.

Generated packets pull severity, asset ids and titles from the same rows the ticket uses. Manual rephrasing is allowed for clarity but not for score changes. Sam's drift incident taught the team that copy-paste between audiences invents two truths. Templates made the dual versions boring and consistent. Reviewers spot-check that generated numbers match the ticket before sending. One source of severity numbers beats two clever paraphrases.

32.8 Glossary for legal readers

A mini glossary maps "conduit", "control", and "finding" for legal readers. Sam attaches it when legal joins late.

Shared words hide different meanings across professions. The mini glossary is one screen and travels as an attachment, not a lecture. Sam updates it when a new misunderstanding appears in a thread. Late-joining counsel get the glossary in the first packet so the second meeting is shorter. Argument about definitions mid-crisis is how deadlines slip. Shared definitions shorten every later meeting by minutes that add up across a quarter.

32.9 Finding RACI fields

Each major finding carries a tiny RACI: who fixes, who verifies, who accepts. Sam fills it in FindingsDesk fields.

Unowned findings age into folklore. The tiny RACI sits on the ticket so accountability is visible without a separate programme management ritual. Sam will not move a major finding to in-progress without the three names. Acceptors must have authority to own residual risk; friends of the team do not qualify. Empty RACI fields block status transitions in the workflow. Named roles turn findings into scheduled work instead of ambient guilt.

32.10 Confirm RACI autosuggest

RACI fields auto-suggest owners from the asset register. Sam still confirms with a human. Autosuggest without confirmation once mailed a finding to a former employee.

Autosuggest is a convenience that can become a confidentiality incident. Sam's confirmation call is short and logged with a timestamp on the ticket. The former-employee mail became a teaching case about trusting directories after HR events. Humans still beat stale graphs when stakes include private vulnerability detail. Confirmation is mandatory even when the suggestion looks obviously right. Human confirmation is cheap insurance against directory rot.

32.11 Deactivated owner near miss

RACI autosuggest once chose a deactivated user; confirmation call caught it. Sam keeps the call even when busy.

Deactivated users lingering in the asset register are a quiet failure mode. The confirmation call caught the miss before mail merged. Sam refuses to drop the call on busy days because busy days are when shortcuts concentrate. A two-minute live check beats a day of recall. Platform tickets now flag deactivated owners in red beside the suggestion. Near misses that change both UI and habit are the reviews worth keeping.

32.12 Owner-confirmed timestamps

Confirmation calls are logged as "owner confirmed 15:04" in the ticket.

A bare checkbox saying confirmed ages poorly when auditors ask who spoke. The log line names the act and the clock so later readers can reconstruct diligence. Sam pastes the line immediately after the call while memory is fresh. Tickets without the line bounce from peer review. The format is dull on purpose so people actually use it. Timestamped diligence survives staff turnover cleanly and keeps auditors from guessing. The discipline sounds small until the first time it prevents a messy recall.

32.13 Business-hours confirmation rule

Owner confirmed timestamps must be during business hours unless on-call is noted.

Night confirmations happen, but they need an on-call note so nobody assumes a sleepy accidental yes. Sam's validator warns when the timestamp falls outside business hours without the note. The rule protects owners as much as it protects the process. On-call notes name the rotation and the ticket that authorised off-hours contact. False urgency is easier to spot when the clock is disciplined. Clock rules make urgency claims easier to audit later when memories disagree.

32.14 Monthly legal office hours

Interdisciplinary office hours invite legal monthly. Sam brings one finding and asks how they would phrase disclosure duties. The mutual translation compounds.

Monthly office hours beat emergency-only contact. Sam brings a single live finding stripped of drama and asks counsel how they would frame duties. Legal brings questions about what evidence they wish testers captured earlier. Both sides leave with sharper templates. Attendance is short and recurring so trust accumulates. Recurring low-stakes practice beats rare high-stakes translation under deadline heat.

Worked example (synthetic TRB)

Sam's F3 packet includes a firewall rule proposal for network and a code-side deny checklist for app-sec.

Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.

Errors and limits

This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.

Exercises

Synthesis

Interdisciplinary work translates one finding into each profession's artifacts.

Continue studying — chapter 32 of 40

← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →