◇ OpenCyber Academy
Engineering · Chapter 43 · English

Chapter 43 — Industry or public-service practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 43 — Industry or public-service practice

Lesson map

Lesson 43 published. Map, example, EX127.

flowchart TD
  N0["Learning outcomes"]
  N1["43.1 The placement"]
  N2["43.2 Tasks"]
  N3["43.3 Conduct"]
  N4["43.4 Public service"]
  N5["43.5 Mentoring"]
  N6["43.6 Reflection"]
  N7["Working with operations"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX127"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["43.1 The placement"]
  N2["43.2 Tasks"]
  N3["43.3 Conduct"]
  N4["43.4 Public service"]
  N5["43.5 Mentoring"]
  N6["43.6 Reflection"]
  N7["Working with operations"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX127"]

[Learning outcomes]
    |
    v
[43.1 The placement]
    |
    v
[43.2 Tasks]
    |
    v
[43.3 Conduct]
    |
    v
[43.4 Public service]
    |
    v
[43.5 Mentoring]
    |
    v
[43.6 Reflection]
    |
    v
[Working with operations]
    |
    v
[Worked example] --> [Exercise EX127]

Learning outcomes

You will (1) work in a professional engineering team on security tasks; (2) apply course knowledge in a real organisation; (3) follow professional conduct and confidentiality; (4) reflect on practice.

43.1 The placement

Kwame spends twelve weeks at Coastline Transit as a placement engineer in Ingrid's platform team, working on the pipeline and the ticket-web application.

Twelve weeks is long enough to take on real responsibilities and see work through from start to finish. Working in the platform team gives Kwame direct contact with the pipeline controls he studied, while the application work keeps him close to the code riders use. Learning goals are agreed in the first week and written into his placement plan.

43.2 Tasks

He triages dependency advisories, writes authorisation tests, improves gate messages, joins on-call shadowing and helps prepare the annual security review.

The tasks mix routine and project work, which reflects real engineering. Advisory triage teaches him how to read advisories quickly and decide what matters. Writing tests and improving messages produces visible results. On-call shadowing shows how alerts feel at night. Preparing the review shows how evidence is gathered across the whole organisation, and why records kept during the year matter.

43.3 Conduct

He signs confidentiality terms, uses only approved systems and data, and never tests outside authorised scope. When he finds an issue in a vendor's widget, he reports it to Ingrid, who handles it with the vendor under the contract.

Reporting the vendor issue through Ingrid, rather than contacting the vendor directly, respects the contract and the relationship Coastline manages. It also follows the practice from earlier chapters of acting within authority. Confidentiality terms cover rider data, internal systems and unreleased plans, and they continue after the placement ends.

43.4 Public service

As a public transport operator, Coastline's priority is safe, reliable service for riders. Kwame sees how security work is balanced with service continuity, such as timing upgrades away from peak travel.

A private company might accept brief outages for faster changes, but a transit operator's riders depend on the service to reach work, hospitals and schools. Security work is planned around that need. Kwame notices that upgrades are often scheduled for late evenings on quiet days, and that emergency fixes go through extra checks to avoid breaking ticket sales during peak hours.

43.5 Mentoring

Weekly meetings with Ingrid review his work and learning goals.

The meetings follow a simple pattern: what Kwame did, what he learned, what he found hard and what comes next. Ingrid asks him to explain his reasoning on one decision each week, which builds the habit of justifying choices. Learning goals are adjusted as the placement goes on, for example adding on-call shadowing once he was comfortable with triage. Notes from each meeting are kept by Kwame and shared with his course tutor, so the course can see his progress and offer support if needed.

43.6 Reflection

Kwame keeps a journal of decisions and lessons, reviewed by his course tutor.

Writing decisions down while they are fresh records the reasons as they were at the time, before hindsight changes them. The tutor's review asks what he would do differently and which course ideas proved useful or needed changing in practice. Kwame notes, for example, that the threat model he learned was helpful, but that real systems had more undocumented flows than expected. Entries avoid confidential details, so the journal can be shared with the course without breaching his placement terms.

Working with operations

Kwame spends two days with Coastline's operations centre to see how security alerts reach them and what information they need. He learns that alerts with clear next steps are handled faster, and he rewrites three pipeline alerts to include a short action and a link to the runbook. Seeing the work from the receiving side changes how he designs alerts.

Feedback

At the end of the placement, Ingrid gives written feedback on strengths and areas to develop.

Worked example

In week eight, Kwame's improved gate messages are rolled out. In the following month, the number of failed builds that are retried without changes drops by half, showing developers now understand and fix the issues instead of retrying.

Synthetic case. The placement is synthetic.

Errors and limits

Placements vary; learning goals should be agreed early.

Exercises

Synthesis

Placements test course knowledge against real constraints and conduct.

Continue studying — chapter 43 of 50

← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →