OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The opening case"]
N2["1.2 From problem to question"]
N3["1.3 Search method"]
N4["1.4 Key terms"]
N5["1.5 Recording"]
N6["1.6 Early sources"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The opening case"]
N2["1.2 From problem to question"]
N3["1.3 Search method"]
N4["1.4 Key terms"]
N5["1.5 Recording"]
N6["1.6 Early sources"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The opening case]
|
v
[1.2 From problem to question]
|
v
[1.3 Search method]
|
v
[1.4 Key terms]
|
v
[1.5 Recording]
|
v
[1.6 Early sources]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) turn an operational problem into a master's research question; (2) search and screen literature systematically; (3) record the search so it can be repeated; (4) define key terms.
1.1 The opening case
Lucas Moreau is a master's student at the fictional Ashcombe University, supervised by Dr Mei Tanaka. His employer, the fictional online retailer Larkspur Retail, had a storage bucket of order exports left publicly readable for nine days. The bucket, tmp-export-0412, had been created by hand in the cloud console during a late-night data request. The security team believes manual console changes cause most exposures; the platform team believes infrastructure-as-code (IaC) templates with weak defaults are just as much to blame.
1.2 From problem to question
Lucas turns the argument into a question he can answer with Larkspur's change records: "Are configuration changes made through the console more likely to expose storage publicly than changes made through reviewed IaC, and what explains any difference?" The question compares two explanations rather than assuming one. The question came out of a real disagreement at Larkspur: the platform team blamed console changes, while the data team pointed to copied IaC templates. Phrasing it as a comparison commits Lucas to reporting whichever way the data fall, and the second clause leaves room for a third explanation neither team had named.
1.3 Search method
He searches two digital libraries and the NIST and CSA publication lists with recorded search strings, dates and result counts. Titles and abstracts are screened against written inclusion criteria: empirical or standards sources on cloud configuration error, IaC security or access control. The criteria were written before screening began and shared with Dr Tanaka, so the reasons for including or excluding a paper do not shift as Lucas reads. The search strings combine terms for misconfiguration, storage exposure, infrastructure as code and access control, and each is saved with the date it was run.
1.4 Key terms
"Exposure" means a storage resource readable without authentication. "Change origin" is console, IaC pipeline or provider API script. "Reviewed" means a second person approved the change. These definitions decide what the study counts. A bucket readable only by a partner's named account is not an exposure; a change made by a script that called the provider's API directly counts as its own origin. Writing the terms down before the data arrive stops them being stretched later to fit a result, as happened when the pilot showed that intended public access needed its own category.
1.5 Recording
The search log, screening decisions and reasons for exclusion are kept so another student could repeat the search and reach the same set. The log also caught Lucas's own bias: when he reviewed his exclusion reasons, two papers arguing that IaC spreads errors widely had been dropped without a valid reason. Dr Tanaka asked him to reinstate them. Without a written record, that pattern would have been invisible to anyone checking the review, including Lucas himself. The search strings and dates are in an appendix, so examiners can rerun the search and check whether other papers were missed.
1.6 Early sources
Mell and Grance (2011) define the service models; the shared responsibility pages of AWS, Microsoft and Google place storage access settings on the customer's side; Rahman et al. (2019) found security smells in IaC scripts, which supports the platform team's concern. These sources frame the question from both sides. The shared responsibility pages show that the misconfiguration is Larkspur's to prevent, whichever route caused it; Rahman et al. give the IaC explanation empirical support. Lucas notes that none of the early sources compares console and IaC exposure rates directly, which is the gap his study addresses.
Worked example
The first search returns 412 records; after screening 31 remain. Lucas notices that he had unconsciously excluded two papers arguing that IaC also spreads errors widely. Dr Tanaka asks him to reinstate them, because a review that only supports one explanation cannot judge between two.
Synthetic case. Larkspur Retail, people and counts are synthetic.
Errors and limits
Searching only for evidence that supports a favoured explanation is confirmation bias.
Exercises
- EX001 — Opening incident. What happened at Larkspur?
Show marking criteria
Rubric: 3 = console-made bucket public 9 days; 2 = partial; 1 = vague; 0 = none. - EX002 — Two explanations. What are the competing explanations?
Show marking criteria
Rubric: 3 = console changes vs weak IaC defaults; 2 = partial; 1 = vague; 0 = none. - EX003 — The question. State Lucas's question.
Show marking criteria
Rubric: 3 = console more likely to expose than reviewed IaC, and why; 2 = partial; 1 = vague; 0 = none. - EX004 — Exposure term. How is exposure defined?
Show marking criteria
Rubric: 3 = readable without authentication; 2 = partial; 1 = vague; 0 = none. - EX005 — Search record. What is recorded about the search?
Show marking criteria
Rubric: 3 = strings, dates, counts, decisions; 2 = three; 1 = one; 0 = none. - EX006 — Reinstated papers. Why were two papers reinstated?
Show marking criteria
Rubric: 3 = avoid confirmation bias; 2 = partial; 1 = vague; 0 = none. - EX007 — Customer side. Whose responsibility are storage access settings?
Show marking criteria
Rubric: 3 = customer; 2 = partial; 1 = vague; 0 = none.
Synthesis
A fair question compares explanations, supported by a repeatable search.