◇ OpenCyber Academy
Professional · Chapter 11 · English

Chapter 11 — Supervised laboratory

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Supervised laboratory

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Rehearsal"]
  N2["11.2 Timing"]
  N3["11.3 Weak points"]
  N4["11.4 Re-run"]
  N5["11.5 Safety"]
  N6["What the rehearsal tests"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Rehearsal"]
  N2["11.2 Timing"]
  N3["11.3 Weak points"]
  N4["11.4 Re-run"]
  N5["11.5 Safety"]
  N6["What the rehearsal tests"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Rehearsal]
    |
    v
[11.2 Timing]
    |
    v
[11.3 Weak points]
    |
    v
[11.4 Re-run]
    |
    v
[11.5 Safety]
    |
    v
[What the rehearsal tests]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) rehearse the full workflow on synthetic data; (2) time each step; (3) identify weak points.

11.1 Rehearsal

Dev gives Hannah a synthetic new service with two roles and four image findings. She runs the full workflow: usage analysis, triage, plan, staging changes, verification, report. The rehearsal tests whether Hannah can apply the whole method on a service she has not seen, without the help of familiar evidence. The synthetic service runs in a separate staging account, so nothing affects the council's real systems. Dev watches but does not help, noting where she pauses or checks her method note. Each step produces the same kind of evidence as the real project, so the result can go into her portfolio. Each rehearsal produces the same records as real work, so the portfolio can show them. Dev schedules rehearsals twice a year so skills stay fresh in the team.

11.2 Timing

The rehearsal takes three hours: one for analysis, one for staging changes, one for verification and report. Splitting the time by stage shows where the method takes longest. Analysis was quick because the method note gives clear steps. Staging changes took an hour because each removal had to be tested. Verification and report took another hour, mostly spent on workload controls. Hannah records the timings so she can compare them with a second rehearsal and see whether her improvements help.

11.3 Weak points

Verification of workload controls took longest because staging lacked a test pod template. Hannah adds one. Without a template, Hannah had to write a non-compliant test pod from scratch to check that Restricted was enforced. Adding a template to staging means future verification only needs the template applied and the rejection recorded. She also writes a short note explaining how to use it. Dev reviews the template to make sure it tests the profile without doing anything harmful, and it is stored with the method note.

11.4 Re-run

A second rehearsal on another synthetic service takes two hours. The shorter time shows that the test pod template and familiarity with the method helped. The second service also had different roles and findings, so the speed did not come from repeating the same answers. Hannah records the timings for both rehearsals in her portfolio. Dev notes that a colleague could run the method too, which was later shown when a colleague completed it from her notes. Dev signs off both rehearsal records, which go into her portfolio as evidence that the workflow can be repeated on unfamiliar services. After the rehearsals, the method note gains a checklist at the top summarising each step and its evidence. Each rehearsal ends with a short debrief on what to improve. Dev approves the method for use on other services.

11.5 Safety

The rehearsal used synthetic services in a separate staging account. Using a separate account means a mistake during rehearsal cannot affect the permit service or residents' data. The synthetic services contain no real records, and their roles and images were designed for the exercise. Dev approved the rehearsal account and its access in writing. Hannah deletes the rehearsal services afterwards and records that the account was cleaned up, so nothing is left running. The cleanup is checked by Dev, who confirms the account is empty.

What the rehearsal tests

The rehearsal tests whether the method works end to end, whether notes are clear enough for others and how long each step takes. Timing helps Dev plan staff time for future services: about two hours for a small service once the method is practised.

The synthetic services include deliberate traps, such as a permission used only once in 90 days, to check that Hannah confirms with owners rather than removing it automatically. She catches it and asks the synthetic owner, as the method requires.

Worked example

Dev asks what would happen if Hannah were away. A colleague runs the rehearsal from her notes in three and a half hours, showing the method is transferable.

Synthetic case. Synthetic.

Errors and limits

Rehearsals with synthetic data may hide complications of real services.

Exercises

Synthesis

Rehearse the workflow and fix its weak points.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →