Chapter 43 — Industry or public-service practice | Engineering Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 43 published. Map, example, EX127.

flowchart TD
  N0["Learning outcomes"]
  N1["43.1 Placement governance"]
  N2["43.2 Community contribution"]
  N3["43.3 Practice log"]
  N4["43.4 Confidential material"]
  N5["43.5 Public-service settings"]
  N6["Practice note — asking questions"]
  N7["Ending the placement"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX127"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["43.1 Placement governance"]
  N2["43.2 Community contribution"]
  N3["43.3 Practice log"]
  N4["43.4 Confidential material"]
  N5["43.5 Public-service settings"]
  N6["Practice note — asking questions"]
  N7["Ending the placement"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX127"]

[Learning outcomes]
    |
    v
[43.1 Placement governance]
    |
    v
[43.2 Community contribution]
    |
    v
[43.3 Practice log]
    |
    v
[43.4 Confidential material]
    |
    v
[43.5 Public-service settings]
    |
    v
[Practice note — asking questions]
    |
    v
[Ending the placement]
    |
    v
[Worked example] --> [Exercise EX127]

Learning outcomes

You will (1) work within an operating organisation's governance; (2) contribute to a sector sharing community responsibly; (3) document professional practice hours and reflections; (4) handle confidential material learned on placement.

43.1 Placement governance

Kofi's placement at BEN is governed by an agreement covering confidentiality, supervision and what he may write about. University assignments draw on synthetic reconstructions, not BEN's real data.

The agreement lists what Kofi may describe in his university work, such as general methods and lessons, and what he may not, such as partner names or real incident details. Any doubtful case goes to his supervisor before submission. Reconstructing a problem with invented data lets him write freely without risk to BEN or its partners, and it is why every case in this book is synthetic.

43.2 Community contribution

As a placement engineer he attends sector ISAC calls as an observer. He learns the community's TLP habits, how members describe incidents, and how trust is built over time by sharing useful, accurate information and acknowledging others' contributions.

Observing first lets him see how the community works before he speaks. Members who share early and correct their own errors openly earn more trust than those who share a great deal of little value. When Kofi later presented a short summary of a synthetic method to the group, he credited the partners whose feedback had shaped it.

43.3 Practice log

He logs tasks, hours, skills used and reflections: what went well, what he would change, what he learned about ethics. Supervisors sign the log.

Kofi writes each entry on the day of the work, while he still remembers what was hard. Reflection entries are short but specific: one recorded that he had nearly shared an AMBER bulletin with a contractor and stopped to check. His supervisor discussed that entry with him, and it became a training example for the next placement student.

43.4 Confidential material

Some information he sees is TLP:RED or commercially sensitive. It never appears in coursework, social media or conversation outside need-to-know. If in doubt, he asks his supervisor.

Kofi keeps a simple rule: if he would not be comfortable seeing a sentence on a slide at a public conference, it does not leave BEN. His notes from ISAC calls stay on BEN's systems. When a lecturer asked the class to discuss a recent incident, he spoke only about the public advisory and said that he could not add more.

43.5 Public-service settings

In a national CERT or regulator, additional rules apply: official secrecy, freedom-of-information obligations and political neutrality. ICD 203's emphasis on independence from political considerations is a useful reference for analysts in public roles.

Kofi spoke with an analyst at the national CERT during a sector event. She described how their reports can be requested under transparency law, which shapes how they record sources. Political neutrality means an analyst presents the evidence the same way whatever a minister may hope to hear. Students considering public roles should expect these duties alongside the technical work.

Practice note — asking questions

Experienced practitioners expect placement students to ask. Asking before acting on unclear sharing rules prevents the kind of mistake that ends a placement.

Ending the placement

At the end of the placement Kofi returns equipment, has his accounts disabled, and confirms in writing that he holds no BEN data on personal devices.

Worked example

A classmate asks Kofi which supplier was compromised in a recent incident he heard about at BEN. He declines, explains that it was shared under TLP:AMBER within BEN, and points the classmate to a public CLEAR advisory on the same campaign.

Synthetic case. The exchange is invented.

Errors and limits

Placement experience is valuable but narrow; reflect on how other organisations differ. Signing a confidentiality agreement does not override legal reporting duties.

Exercises

EX127 — Coursework source. May Kofi base a university assignment on BEN's real incident data? Explain.
Show marking criteria
Rubric: 3 = no; use synthetic reconstructions per agreement; 2 = no; 1 = yes; 0 = none.
EX128 — Reflection entry. Write a short practice-log reflection about a sharing decision.
Show marking criteria
Rubric: 3 = task, what went well/badly, ethics lesson; 2 = two; 1 = task only; 0 = none.
EX129 — Classmate request. What was correct about Kofi's response to his classmate?
Show marking criteria
Rubric: 3 = declined restricted info; cited TLP; offered public alternative; 2 = declined; 1 = shared; 0 = none.

Synthesis

Work inside governance, contribute to trust, log and reflect, and keep restricted material where it belongs.

Continue studying — chapter 43 of 50

← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →