◇ OpenCyber Academy
Professional · Chapter 3 · English

Chapter 3 — Authorized practice and evidence handling

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Authorized practice and evidence handling

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Written authorisation"]
  N2["3.2 Minimal evidence"]
  N3["3.3 Secrets found on the job"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Written authorisation"]
  N2["3.2 Minimal evidence"]
  N3["3.3 Secrets found on the job"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Written authorisation]
    |
    v
[3.2 Minimal evidence]
    |
    v
[3.3 Secrets found on the job]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) work under a written authorisation; (2) handle evidence and client data minimally; (3) protect secrets discovered during an engagement.

3.1 Written authorisation

Copperleaf never tests a client system without a signed authorisation. For Bayside it lists the systems in scope, such as the booking site, the clinic server and staff laptops; permitted checks, such as certificate reads, TLS configuration scans and file permission reviews; the dates; and an emergency contact. The payment processor and the cloud host are excluded, because Bayside cannot authorise testing of someone else's systems. Dana keeps a copy of the authorisation with her notes and stops immediately if a check would touch anything not listed, even when the extra target is only one hostname away.

3.2 Minimal evidence

Health data raises the stakes. When Dana checks backup encryption, she records the backup job settings and a test restore of a synthetic file, never a patient record. Evidence includes the command or screen used, the time with zone, the system and the result, stored in Copperleaf's evidence folder with access limited to the engagement team. She keeps only what supports a finding. Marcus explains that evidence is itself sensitive: a folder of configuration exports from a clinic is a target, so it is encrypted at rest and deleted on the schedule agreed in the contract.

3.3 Secrets found on the job

On the clinic server Dana finds a text file holding the database administrator password and the agency's FTP credentials. She does not open them further, copy them or test whether they work. She records the file path, the type of secret and the time, informs Marcus and the client's technical owner the same day, and recommends rotation. Testing a found credential, even to prove the risk, would go beyond her authorisation and could break systems. Her report later shows the finding with the secrets redacted, which is enough to justify the fix.

Worked example

Dana works through a day of Bayside checks under the signed authorisation, keeps evidence minimal and reports a password file by path only.

Synthetic case. The authorisation, server and password file are synthetic.

Errors and limits

Authorisation does not remove the need for care in production. Retention rules differ by contract and jurisdiction.

Exercises

Synthesis

Authorised, minimal and careful evidence handling keeps an engagement lawful and stops it from creating new exposure.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →