◇ OpenCyber Academy
Professional · Chapter 2 · English

Chapter 2 — Cryptography and trust services: service and stakeholder context

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Cryptography and trust services: service and stakeholder context

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Who cares about what"]
  N2["2.2 Owners and suppliers"]
  N3["2.3 Stakeholder language"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Who cares about what"]
  N2["2.2 Owners and suppliers"]
  N3["2.3 Stakeholder language"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Who cares about what]
    |
    v
[2.2 Owners and suppliers]
    |
    v
[2.3 Stakeholder language]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) identify the stakeholders affected by a client's cryptographic services; (2) record service owners and suppliers; (3) explain findings in stakeholder language.

2.1 Who cares about what

Marcus asks Dana to list the people affected by Bayside's cryptography. Patients care that the booking site is private and does not show warnings. The clinic manager cares about cost, downtime and regulatory duties for health data. Reception staff care that laptops start and email works. The payment processor cares that Bayside verifies its notifications and protects card data. The website developer, a small outside agency, cares about certificate renewals they set up years ago. Each stakeholder hears the same finding differently, so Dana learns to write it in terms of what each one needs to know or do.

2.2 Owners and suppliers

For each service Dana records the business owner, the technical owner and the supplier. The booking site is owned by the clinic manager, run technically by the agency and hosted by a cloud provider. The email service is a managed platform where the supplier controls the keys. The practice-management database runs on a server in the main clinic, maintained by Copperleaf. This table answers two practical questions: who must approve a change, and who can actually make it. Without it, Dana once spent a day trying to fix a certificate that only the agency could renew.

2.3 Stakeholder language

Dana's first draft finding said that the booking site served an incomplete certificate chain. The clinic manager did not understand it. Marcus helps her rewrite it: some patients on older phones see a security warning when booking, because the website is missing a file that proves its certificate is genuine; the agency can fix it in under an hour at no extra cost. The technical detail stays in an appendix for the agency. Translating findings this way is not simplifying the truth; it is choosing which part of the truth each reader needs in order to act.

Worked example

Dana builds a stakeholder table for Bayside and rewrites the chain finding twice, once for the clinic manager and once for the agency.

Synthetic case. Stakeholders, suppliers and the chain finding are synthetic.

Errors and limits

Owner tables go stale when suppliers change. Plain language must not drop facts that change the decision.

Exercises

Synthesis

Cryptographic findings matter only when the right owner understands them, so practitioners map stakeholders and write for each.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →