Chapter 5 — Engineering communication
Lesson map
Lesson 05 published. Map, example, EX013.
flowchart TD
N0["Learning outcomes"]
N1["5.1 Writing findings"]
N2["5.2 Presenting risk"]
N3["5.3 Diagrams"]
N4["5.4 Decision records"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX013"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 Writing findings"]
N2["5.2 Presenting risk"]
N3["5.3 Diagrams"]
N4["5.4 Decision records"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]
[Learning outcomes]
|
v
[5.1 Writing findings]
|
v
[5.2 Presenting risk]
|
v
[5.3 Diagrams]
|
v
[5.4 Decision records]
|
v
[Worked example] --> [Exercise EX013]
Learning outcomes
You will (1) write clear security findings; (2) present risk to non-specialists; (3) document decisions for later readers.
5.1 Writing findings
Lindiwe's first placement task is writing up a finding: a file share readable by all staff contains scanned driver licences. Prof. Hale shows her a structure: what was found, where, why it matters, how likely misuse is and what to do. She avoids jargon such as world-readable in the summary and writes that any employee can open the folder. The finding is short, specific and gives the owner a clear next action. The folder owner, a depot administrator, moves the scans to a restricted share the same afternoon.
5.2 Presenting risk
Lindiwe presents three findings to depot managers. Instead of scores, she describes plausible consequences: a stolen licence scan could support identity fraud against a driver. Managers ask which finding to fix first. She explains likelihood and impact in plain terms and recommends starting with the licence folder because exposure is wide and the fix is quick. She learns that risk communication succeeds when listeners can act on it immediately. Two managers ask for the same briefing for their supervisors, and Lindiwe shortens it to a single page with the three findings and their owners.
5.3 Diagrams
Lindiwe draws a simple network diagram for the presentation, showing depots, the head office and the cloud email service. Prof. Hale asks her to mark trust boundaries, where data cross from one zone of control to another, because those are where controls belong. She removes decorative icons and labels every arrow with the data it carries. The diagram becomes a tool for discussion rather than a picture, and later readers can update it. She stores the diagram beside the current network documentation.
5.4 Decision records
Decisions fade from memory. Lindiwe writes a short decision record for the licence folder: context, options considered, decision, owner and date. Months later, an auditor asks why the folder was moved rather than deleted, and the record answers immediately: drivers' licences must be retained for insurance checks. She learns that recording reasons protects an organisation from repeating debates and helps auditors see that risks were handled deliberately. Saltmarsh adopts her template for all security decisions, and the records are kept in a shared folder with the owner's name on each, which makes later audits faster.
Worked example
Lindiwe writes a structured finding about exposed licence scans, presents it by consequence, draws a diagram with trust boundaries and records the decision.
Synthetic case. Findings are synthetic.
Errors and limits
A finding without a clear owner and action rarely gets fixed.
Exercises
- EX013 — Finding structure. Name the parts of a finding. Rubric: 3 = found, where, why, likelihood, action;; 2 = most;; 1 = few;; 0 = none.
- EX014 — Trust boundaries. What does Prof. Hale ask her to mark? Rubric: 3 = trust boundaries;; 2 = partly correct;; 1 = other;; 0 = none.
- EX015 — Record answer. Why was the folder moved rather than deleted? Rubric: 3 = licences are retained for insurance checks;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 05 (chapter 05 of 50)
← Chapter 04 · Course chapter index · Chapter 06 →
Continue to the next authored lesson.