Chapter 24 — Information security: methods I | Engineering Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Information security: methods I

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Planning an assessment"]
  N2["24.2 Evidence collection"]
  N3["24.3 Observations and conclusions"]
  N4["24.4 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Planning an assessment"]
  N2["24.2 Evidence collection"]
  N3["24.3 Observations and conclusions"]
  N4["24.4 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Planning an assessment]
    |
    v
[24.2 Evidence collection]
    |
    v
[24.3 Observations and conclusions]
    |
    v
[24.4 Reporting]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) plan a security assessment; (2) collect evidence systematically; (3) separate observations from conclusions.

24.1 Planning an assessment

Lindiwe plans her first formal assessment of one depot. She writes the scope, objectives, methods, schedule and authorisation, and the depot manager and security lead sign it. Methods include interviews, configuration review, a network scan within the depot's segment and a walk-through of physical controls. Prof. Hale stresses that written authorisation protects both the assessor and the organisation, especially for scans that might disrupt equipment if run carelessly. The plan also states which hours scans may run, avoiding the busy morning dispatch period when the depot's systems carry their heaviest load.

24.2 Evidence collection

During the assessment, Lindiwe records evidence with time, source and method: screenshots of configurations, scan outputs and interview notes signed by interviewees. She stores evidence in a restricted folder with checksums so later readers can confirm it has not changed. She learns that conclusions are only as strong as the evidence beneath them, and that recording how evidence was obtained lets others judge its reliability and repeat the checks. She lists every evidence item in an index with its checksum, so a reviewer can pick any item and confirm it matches the original record.

24.3 Observations and conclusions

Lindiwe separates what she observed from what she concludes. She observed that the depot's backup drive sits in an unlocked office; she concludes that backups could be stolen or damaged. She observed that two staff share a login on the goods-in terminal; she concludes that actions there cannot be attributed. Prof. Hale explains that this separation lets readers accept the facts even if they weigh the conclusions differently. She applies this layout to every finding in the report. The depot manager later says the separation made the findings easier to accept and act on.

24.4 Reporting

Her report lists eight findings, each with evidence, conclusion, risk rating and recommendation. She shares a draft with the depot manager, who corrects one factual error: a door she thought unlocked has a code lock she had missed. She revises the finding. She learns that checking facts with those responsible improves accuracy and acceptance, and that defending an error to protect one's report damages credibility. The final report goes to the security lead and the depot manager. Within a month, six of the eight findings are closed, and the remaining two have agreed dates.

Worked example

Lindiwe plans and authorises a depot assessment, records evidence with checksums, separates observations from conclusions and corrects a factual error after review.

Synthetic case. The assessment is synthetic.

Errors and limits

Mixing observations with conclusions makes reports harder to verify.

Exercises

EX070 — Signed plan. Who signs the assessment plan? Rubric: 3 = the depot manager and security lead;; 2 = partly correct;; 1 = vague;; 0 = none.
EX071 — Evidence integrity. How does she protect evidence integrity? Rubric: 3 = checksums in a restricted folder;; 2 = partly correct;; 1 = vague;; 0 = none.
EX072 — Corrected error. What factual error is corrected? Rubric: 3 = a door with a code lock she missed;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 24 (chapter 24 of 50)

← Chapter 23 · Course chapter index · Chapter 25 →

Continue to the next authored lesson.