Chapter 36 — Field or community practice
Lesson map
Lesson 36 published. Map, example, EX106.
flowchart TD
N0["Learning outcomes"]
N1["36.1 The placement"]
N2["36.2 Understanding the setting"]
N3["36.3 Practical improvements"]
N4["36.4 Teaching"]
N5["36.5 Simple procedures"]
N6["36.6 Boundaries"]
N7["36.7 Reflection"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX106"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["36.1 The placement"]
N2["36.2 Understanding the setting"]
N3["36.3 Practical improvements"]
N4["36.4 Teaching"]
N5["36.5 Simple procedures"]
N6["36.6 Boundaries"]
N7["36.7 Reflection"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX106"]
[Learning outcomes]
|
v
[36.1 The placement]
|
v
[36.2 Understanding the setting]
|
v
[36.3 Practical improvements]
|
v
[36.4 Teaching]
|
v
[36.5 Simple procedures]
|
v
[36.6 Boundaries]
|
v
[36.7 Reflection]
|
v
[Worked example] --> [Exercise EX106]
Learning outcomes
You will (1) apply SOC skills in a community setting; (2) adapt advice to small organisations; (3) teach basic security practices; (4) reflect on community engagement.
36.1 The placement
As part of the degree, Lucas spends four weeks helping a local charity, the fictional Eastbank Youth Centre, which has twelve staff, a cloud mail service and no IT team.
Eastbank's situation is common among small charities: cloud services set up by a volunteer years ago, shared passwords and no one whose job includes security. Four weeks is short, so Lucas agreed with the manager on three goals at the start: stronger sign-in, alerts that someone reads and staff who know what to do.
36.2 Understanding the setting
The charity cannot run a SOC. Its risks are similar to Riverton's on a small scale: phishing, account compromise and lost devices.
Lucas spent his first days asking staff how they work: who uses which devices, who has administrator rights and how they share files. Several staff used personal phones for mail. That shaped his advice, since rules requiring managed devices would be impossible for a charity with no IT budget. He also learned that the manager shared her administrator password with a volunteer, which became the first thing they changed together.
36.3 Practical improvements
With the manager's permission, Lucas helps enable MFA for all staff, turns on the mail service's built-in alerts for suspicious sign-ins and forwarding rules, and sets alerts to go to two named staff members.
These three changes reuse what the mail service already offers, so they cost nothing and need no ongoing technical work. Two named staff receive alerts so one absence does not leave them unread. Lucas tested each alert with the manager's own account before leaving, so they knew what a real one looked like.
36.4 Teaching
He runs a 30-minute session on recognising phishing and how to report it, using examples adapted from Riverton's campaign with all identifying details removed.
Adapting Riverton's campaign gave staff a realistic example: an urgent-sounding message, a look-alike link and a fake sign-in page. Lucas explained what to look for and, more importantly, that reporting quickly matters more than never clicking. Staff practised forwarding a sample email to the reporting address. Staff asked practical questions, such as what to do if they were unsure, and Lucas's answer was always to report and let someone else decide.
36.5 Simple procedures
A one-page "what to do if" sheet covers clicked links, lost phones and strange emails, with contact numbers.
The sheet is written in plain language and pinned in the office as well as shared by email. For a clicked link, it says to change the password, tell the manager and check for strange forwarding rules, with screenshots showing where to look. Lucas tested the sheet by asking a staff member to follow it. The staff member found one step confusing, which Lucas rewrote.
36.6 Boundaries
Lucas does not access staff mailboxes or personal data; he configures settings with the manager present and leaves documentation.
Working with the manager present means every change is understood by someone who stays. Lucas's documentation lists each setting changed and how to reverse it. He did not keep any administrator access after the placement, which the manager confirmed by removing his temporary account. When a staff member asked him to look into a strange email in her inbox, he talked her through checking it herself rather than opening her mailbox. That kept him within the agreed limits and left her more confident.
36.7 Reflection
Advice must fit the organisation's capacity; a perfect plan the charity cannot maintain is worse than a simple one it can.
Lucas initially drafted a ten-page security plan, then realised nobody at Eastbank would read or maintain it. The final version, three settings and one sheet, was used within two weeks. Matching advice to capacity is a skill that applies equally inside larger organisations. He also notes that the charity's staff taught him things about their work that changed his advice, such as the need to email families from personal phones during evening activities. Listening first made his recommendations usable.
Handing over
Before leaving, Lucas walks the two named staff through the alert emails and the one-page sheet, and arranges a check-in call a month later.
Worked example
Two weeks after the session, a staff member reports a suspicious email using the new sheet; the built-in alert also fires for a forwarding rule created on her account after she entered her password. The manager follows the sheet: resets the password and removes the rule. No data left the account.
Synthetic case. The charity and events are invented.
Errors and limits
Community help is limited by time; leave documentation and contacts so improvements last.
Exercises
- EX106 — Built-in alerts. Which built-in alerts were enabled? Rubric: 3 = suspicious sign-ins and forwarding rules; 2 = one; 1 = vague; 0 = none.
- EX107 — Boundaries. What boundaries did Lucas keep? Rubric: 3 = no mailbox or personal data access; configure with manager present; documentation; 2 = partial; 1 = vague; 0 = none.
- EX108 — Capacity principle. Why must advice fit the charity's capacity? Rubric: 3 = unmaintainable perfect plan worse than simple maintainable one; 2 = partial; 1 = vague; 0 = none.
Synthesis
Community practice adapts SOC thinking to small organisations through simple controls, teaching and lasting documentation.
Continue studying — chapter 36 of 40
← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →