Chapter 43 — Industry or public-service practice | Engineering Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 43 — Industry or public-service practice

Lesson map

Lesson 43 published. Map, example, EX127.

flowchart TD
  N0["Learning outcomes"]
  N1["43.1 The placement"]
  N2["43.2 Confidentiality"]
  N3["43.3 Audit preparation"]
  N4["43.4 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX127"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["43.1 The placement"]
  N2["43.2 Confidentiality"]
  N3["43.3 Audit preparation"]
  N4["43.4 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX127"]

[Learning outcomes]
    |
    v
[43.1 The placement]
    |
    v
[43.2 Confidentiality]
    |
    v
[43.3 Audit preparation]
    |
    v
[43.4 Reflection]
    |
    v
[Worked example] --> [Exercise EX127]

Learning outcomes

You will (1) work within a professional security team; (2) handle confidential information responsibly; (3) reflect on professional practice.

43.1 The placement

Lindiwe spends a semester working full-time in Saltmarsh's security team. She joins the daily stand-up, takes a share of alert reviews and supports an audit preparation. She notices how much work involves coordination: persuading owners to fix findings, scheduling changes around depot peaks and explaining risks to finance. Prof. Hale visits mid-placement and asks her which skills she uses most; she answers writing and negotiation, more than coding. She keeps a weekly journal recording what she did, what she learned and which conversations changed decisions.

43.2 Confidentiality

The placement gives Lindiwe access to sensitive information: incident details, vulnerability lists and customer complaints. She signs a confidentiality agreement and follows the rule that course work uses only synthetic data. When a classmate asks about a real incident, she declines to share details. Prof. Hale notes that professional trust depends on discretion, and that security staff must model the handling they ask of others. Her reflections for the course describe the kinds of work she did without revealing any real names, systems or incident details.

43.3 Audit preparation

Saltmarsh prepares for an external audit against its management system. Lindiwe helps gather evidence: risk assessment records, the statement of applicability, access reviews and restore test results. She finds two controls listed as implemented whose evidence is incomplete. Rather than presenting them as complete, the team marks them as in progress with dates. The auditor later notes the honesty favourably. She learns that audits reward accurate records more than polished claims. Lindiwe adds the evidence gaps to the team's tracker with owners.

43.4 Reflection

At the end of the placement, Lindiwe writes a reflection on professional practice. She notes that technical skill earns credibility, but influence comes from understanding the business and communicating clearly. She also notes the emotional side of incidents: staff whose accounts were phished felt embarrassed, and calm, blameless handling helped them report quickly next time. Prof. Hale asks her to carry these lessons into her capstone. She shares the reflection with the security lead, who adds two points from the team's perspective about how her questions improved their own documentation.

Worked example

Lindiwe works in Saltmarsh's security team, keeps real details confidential, helps prepare honest audit evidence and reflects on communication and blameless handling.

Synthetic case. The placement is synthetic.

Errors and limits

Presenting incomplete controls as implemented misleads auditors.

Exercises

EX127 — Most-used skills. Which skills does Lindiwe use most? Rubric: 3 = writing and negotiation;; 2 = partly correct;; 1 = coding;; 0 = none.
EX128 — Incomplete evidence. How are the two incomplete controls presented? Rubric: 3 = as in progress with dates;; 2 = partly correct;; 1 = complete;; 0 = none.
EX129 — Blameless effect. What did blameless handling encourage? Rubric: 3 = quicker reporting next time;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 43 (chapter 43 of 50)

← Chapter 42 · Course chapter index · Chapter 44 →

Continue to the next authored lesson.