◇ OpenCyber Academy
Professional · Chapter 11 · English

Chapter 11 — Supervised laboratory

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Supervised laboratory

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 The exercise"]
  N2["11.2 Steps"]
  N3["11.3 Supervision"]
  N4["11.4 The report"]
  N5["11.5 Assessment"]
  N6["11.6 Reflection"]
  N7["Preparing for the lab"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 The exercise"]
  N2["11.2 Steps"]
  N3["11.3 Supervision"]
  N4["11.4 The report"]
  N5["11.5 Assessment"]
  N6["11.6 Reflection"]
  N7["Preparing for the lab"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 The exercise]
    |
    v
[11.2 Steps]
    |
    v
[11.3 Supervision]
    |
    v
[11.4 The report]
    |
    v
[11.5 Assessment]
    |
    v
[11.6 Reflection]
    |
    v
[Preparing for the lab]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) run a supervised end-to-end exercise on synthetic projects; (2) apply source checks, triage and targets; (3) produce a report; (4) reflect.

11.1 The exercise

Marcus sets a supervised lab with a synthetic project, depot-scan, containing lock files, scanner outputs and ticket records. Priya has three hours to produce a report. Using a synthetic project means Priya can practise the whole workflow without any risk to real systems. The project includes the same kinds of problems as TrackPort: an internal name resolved publicly, a similar name, duplicated scanner findings and past tickets. Three hours is enough to work carefully but tests whether she can prioritise. She completed the report in two hours forty minutes.

11.2 Steps

Run the source check (one internal name resolved publicly, one similar name); triage scanner findings (deduplicate, rank by reachability); assign targets and owners; measure past remediation; write the report. Each step repeats a method Priya used at Harbourline, applied to a project she has not seen. The steps follow the order of the real workflow, so she cannot measure remediation before she knows what was found. Marcus checks whether she explains each result and decides what matters, rather than copying lab output into the report.

11.3 Supervision

Marcus observes, answers questions about context, and stops any step that would touch real systems. The lab environment has no network access to public registries. Marcus answers questions that a real team would answer, such as whether a function is called from production code, but does not give hints about findings. The lab has no network access to public registries, so no step could reach a real system even by mistake. He records any question Priya asked and how she used the answer in her report.

11.4 The report

A two-page report with findings, evidence, recommendations and an executive summary of five lines. Keeping the report to two pages forces Priya to choose what matters. The five-line summary is written for a manager who will read nothing else. Findings follow the standard structure with evidence, impact, recommendation, owner and target. Marcus marked one recommendation as unclear about its owner, and Priya fixed it. The report became a training example for the next trainee. Marcus keeps the original draft beside the corrected one, so the training example shows how an unclear owner was fixed.

11.5 Assessment

Marcus scores completeness, accuracy, prioritisation and clarity. Completeness checks that every part of the task was done; accuracy checks the findings against the lab's known answers; prioritisation checks that the most important issues come first with reasons; clarity checks that the report can be acted on by its readers. Marcus records a score and a comment for each criterion, which go into Priya's portfolio. Priya's score passes each criterion, with clarity the lowest because of the unclear recommendation owner, which she fixed before the report was filed.

11.6 Reflection

Priya notes where she hesitated: deciding reachability without the call graph. Without a call graph, Priya had to read code to decide whether vulnerable functions were reachable, and she was not always sure. She records this as a skill to develop and as a limitation of manual review. Her development plan includes learning a call-graph tool, so reachability decisions can be checked more reliably. Marcus agrees this is the right next step. She plans to repeat the depot-scan lab with such a tool and compare the results with her manual judgements.

Preparing for the lab

Before the lab, Priya reviews her scripts, the workflow and the report template. She practises on a smaller synthetic project to check her timing. On the day, she reads all inputs before starting, which helps her see that two scanner outputs overlapped. The lab instructions also remind her that the depot-scan names and data are synthetic and must not be compared with real registries. Her notes from the lab, including the questions she asked Marcus, are added to the portfolio as evidence of method.

Timing

Priya keeps a timestamp for each step, showing triage took longest at about an hour.

Worked example

Priya completes the report in two hours forty minutes. Marcus marks one recommendation as unclear about its owner; Priya fixes it. The lab report becomes a training example for the next security trainee.

Synthetic case. The lab is synthetic.

Errors and limits

A supervised lab tests method under time; real cases add politics and missing data.

Exercises

Synthesis

Practise the whole method under supervision.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →