Chapter 36 — Field or community practice | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 36 published. Map, example, EX106.

flowchart TD
  N0["Learning outcomes"]
  N1["36.1 Placement"]
  N2["36.2 Preparing a contribution"]
  N3["36.3 Community norms"]
  N4["36.4 Feedback"]
  N5["36.5 Reflection"]
  N6["36.6 Community practice beyond work"]
  N7["Mentoring"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX106"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["36.1 Placement"]
  N2["36.2 Preparing a contribution"]
  N3["36.3 Community norms"]
  N4["36.4 Feedback"]
  N5["36.5 Reflection"]
  N6["36.6 Community practice beyond work"]
  N7["Mentoring"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX106"]

[Learning outcomes]
    |
    v
[36.1 Placement]
    |
    v
[36.2 Preparing a contribution]
    |
    v
[36.3 Community norms]
    |
    v
[36.4 Feedback]
    |
    v
[36.5 Reflection]
    |
    v
[36.6 Community practice beyond work]
    |
    v
[Mentoring]
    |
    v
[Worked example] --> [Exercise EX106]

Learning outcomes

You will (1) contribute to a sharing community responsibly; (2) prepare an item for HSSC; (3) give and receive feedback in a community; (4) reflect on professional conduct.

36.1 Placement

During field practice Amara spends four weeks with HSSC's coordination desk, under its membership agreement and a confidentiality undertaking. She sees how items arrive, are checked and are distributed.

Amara's role is to observe and help with routine checks, not to make sharing decisions. The undertaking forbids her from using anything she sees at HSSC in her HCHT work unless it was distributed to HCHT through the normal channel. She keeps a log of her tasks, separate from any member information, which she later uses for her reflective journal and placement report.

36.2 Preparing a contribution

A good contribution is relevant to members, verified, redacted, labelled with TLP and clear about confidence. It includes what was observed, when, and what members can do. NIST SP 800-150 notes that organisations should establish sharing rules and protect sensitive information before contributing.

Amara helps prepare an HCHT contribution about a phishing campaign, using the redaction script and the source grading she learned earlier. The desk checks it, asks her to state the confidence more clearly and publishes it at TLP:GREEN. Two members later report the same sender in their own logs, which raises confidence for everyone.

36.3 Community norms

Respect labels absolutely; credit sources; correct errors publicly within the community; do not use member information for commercial advantage. Trust is the community's only currency.

Amara sees these norms applied when a member mistakenly forwards a TLP:AMBER item to a supplier. The desk asks the member to recall it, records the incident and reminds all members of the rules without naming anyone. The norm of public correction applies to errors in content, while handling mistakes are dealt with privately, so members are not afraid to report them. Trust survives because the response is consistent and fair.

36.4 Feedback

When a member reports that an indicator caused false positives, the desk updates the item and thanks them. Feedback is how the community learns.

Amara helps process feedback during her placement: she records each report of a false positive, checks the item's evidence and drafts an update for the desk to approve. One indicator turned out to be a shared hosting address and was withdrawn. Members who report problems see their feedback acted on, which encourages them to report again.

36.5 Reflection

Amara keeps a reflective journal: what surprised her, what she would do differently, what professional standards she saw tested.

She writes an entry at the end of each day, while details are fresh, and reviews the journal weekly. One entry records her surprise at how much of the desk's time goes to checking labels and redaction rather than analysis. Another notes a moment when she was unsure whether she could discuss an item with her HCHT supervisor, and how she resolved it by asking the desk. The journal becomes evidence for her placement assessment.

36.6 Community practice beyond work

Some students volunteer with public-interest projects, such as helping small charities understand phishing. Such work needs the same discipline: clear scope agreed in writing, no access to systems without permission, and no collection of personal data beyond what the charity asks to protect.

Amara volunteers for a few hours with a local charity. With the manager's written agreement, she runs a short session on recognising phishing and reviews the charity's email settings with its volunteer administrator. She does not log in to any system herself, and the session uses examples from public sources rather than HCHT or HSSC material. Her notes record the scope and what was agreed.

Mentoring

Each placement student has a named mentor who reviews every outgoing item. Asking questions early is expected; mentors prefer ten small questions to one serious mistake.

Worked example

Amara drafts her first HSSC item about a voicemail-themed phishing lure seen at HCHT. Her mentor returns it: the sample still contains a ward extension number. She redacts it, adds a TLP:GREEN label and a short "what to do" line, and the item goes out. Two members report blocking the sender.

Synthetic case. The lure and responses are invented.

Errors and limits

Placements expose students to restricted material; confidentiality continues after the placement ends.

Exercises

EX106 — Missed extension. What did Amara miss in her first HSSC draft, and why does it matter?
Show marking criteria
Rubric: 3 = ward extension number—identifies staff/internal detail; 2 = item only; 1 = vague; 0 = none.
EX107 — Community currency. Explain why respecting labels matters so much in a sharing community.
Show marking criteria
Rubric: 3 = trust; breaches make members stop sharing; 2 = partial; 1 = rules only; 0 = none.
EX108 — Contribution checklist. List four qualities of a good contribution.
Show marking criteria
Rubric: 3 = four of relevant, verified, redacted, labelled, confidence, actions; 2 = three; 1 = one; 0 = none.

Synthesis

Contribute verified, redacted, labelled items; honour norms; welcome feedback; reflect on conduct.

Continue studying — chapter 36 of 40

← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →