Chapter 36 — Field or community practice

Lesson map

Lesson 36 published. Map, example, EX106.

flowchart TD
  N0["Learning outcomes"]
  N1["36.1 What a bachelor's student can safely offer"]
  N2["36.2 The agreement"]
  N3["36.3 Working with small operators"]
  N4["36.4 Reflective journal"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX106"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["36.1 What a bachelor's student can safely offer"]
  N2["36.2 The agreement"]
  N3["36.3 Working with small operators"]
  N4["36.4 Reflective journal"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX106"]

[Learning outcomes]
    |
    v
[36.1 What a bachelor's student can safely offer]
    |
    v
[36.2 The agreement]
    |
    v
[36.3 Working with small operators]
    |
    v
[36.4 Reflective journal]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX106]

Learning outcomes

You will (1) plan a supervised placement or community project with a utility, school or municipality; (2) agree a written scope that excludes live testing; (3) deliver awareness or inventory work that helps a small operator; and (4) reflect on practice using a structured journal.

36.1 What a bachelor's student can safely offer

Small water utilities, schools with building-management systems and community heating co-operatives often lack security staff. A student under supervision can help with documentation-heavy, low-risk work: an asset list from existing records, a review of remote-access arrangements, a password-hygiene checklist, an awareness session for operators. None of these needs touching a live controller.

Each of these tasks uses records or conversations rather than access to controllers, so a mistake costs time but cannot stop a pump or a boiler. Maya's asset list for the heating co-operative is an example: built from invoices and drawings, it still found an undocumented cellular router in the boiler house.

36.2 The agreement

The placement agreement names the host organisation's responsible person, the supervisor, the deliverables, data-handling rules (what leaves the site, how it is stored and when it is deleted) and an explicit prohibition on scanning, probing or configuration changes. If the host asks for "a quick scan", the student refers the request to the supervisor.

When the co-operative's manager asked Maya to "run a scan to see if we're hacked", the agreement gave her the answer: decline politely, explain that scanning is outside the agreed scope, offer the documentation review instead and pass the request to her supervisor.

36.3 Working with small operators

Advice must fit their budget and staff. "Deploy a SOC" is useless to a three-person co-operative; "remove the always-on remote-desktop tool and use the vendor's on-demand session feature, enabled by the manager's phone" is actionable. CISA's free resources for small water and wastewater systems are an example of guidance written for this audience.

The remote-access example also fits a three-person co-operative because it needs no new equipment and no monitoring staff, only a change in how the vendor connects. Maya's recommendation for the boiler-house router follows the same pattern: confirm its purpose, disable it if unneeded, and otherwise allow the vendor to use it only on request.

36.4 Reflective journal

After each visit record: what I did, what I observed, what surprised me, what I would do differently, and any ethical question that arose. Reflection turns activity into learning.

Maya's entry after the boiler-house visit might read: did, built an asset list from invoices and drawings; observed, a cellular router in the boiler house that no invoice mentioned; surprised, the manager did not know it existed, though it predated his time; differently, ask for the panel builder's commissioning documents before the visit, not after; ethical question, the manager's request to "run a scan", which she declined and passed to her supervisor. The entry names no address or credential, so it can be shown to an assessor as written.

Worked example (synthetic)

Maya's placement with a fictional village heating co-operative produces a two-page asset list built from invoices and the panel builder's drawings, discovering an undocumented cellular router in the boiler house. Her recommendation: confirm with the panel builder what it is for, disable it if unneeded, and otherwise require the vendor to enable it only on request.

Synthetic case — fictional village co-operative. The co-operative and router are invented.

Errors and limits

A student is not a consultant; recommendations are reviewed by the supervisor before delivery. Community work must not create dependence the student cannot sustain after the placement.

Exercises

• EX106 — Responding to a scan request. The co-operative manager asks Maya to "run a scan to see if we're hacked". Write her reply.
  Show marking criteria

  Rubric: 3 = declines politely, explains scope, offers safe alternative, refers to supervisor; 2 = three; 1 = agrees with caveats; 0 = runs it.
• EX107 — Data-handling rule. Write one data-handling rule for the asset list.
  Show marking criteria

  Rubric: 3 = where stored, who may access, deletion date; 2 = two; 1 = "keep it safe"; 0 = none.
• EX108 — A journal entry. Write the "what surprised me" line about the cellular router.
  Show marking criteria

  Rubric: 3 = specific observation and lesson about undocumented paths; 2 = observation only; 1 = generic; 0 = none.

Synthesis

Field practice lets students help small operators with documentation and judgement, bounded by written agreements that keep live systems untouched.

Continue studying — chapter 36 of 40

← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →