◇ OpenCyber Academy
Professional · Chapter 6 · English

Chapter 6 — Cryptography and trust services: operational workflow

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Cryptography and trust services: operational workflow

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 The monthly workflow"]
  N2["6.2 Tracking findings"]
  N3["6.3 Handing off fixes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 The monthly workflow"]
  N2["6.2 Tracking findings"]
  N3["6.3 Handing off fixes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 The monthly workflow]
    |
    v
[6.2 Tracking findings]
    |
    v
[6.3 Handing off fixes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) run Copperleaf's monthly cryptographic check workflow; (2) track findings from discovery to closure; (3) hand off fixes to the right owner.

6.1 The monthly workflow

Copperleaf runs a monthly cryptographic check for each client. Step one exports the inventory and runs the baseline script. Step two confirms flags by hand. Step three checks certificate transparency logs, defined in RFC 6962, for any certificate issued for the client's domains that the inventory does not list. Step four rates and records findings in the tracker. Step five sends the client summary. Dana follows a checklist for each step and signs it off with the date. A checklist sounds dull, but it is what makes the workflow repeatable when Dana is ill and a colleague runs it instead.

6.2 Tracking findings

Each finding gets an identifier, a description, the evidence link, a risk rating, an owner, a due date and a status: open, in progress, fixed awaiting verification or closed. A finding is closed only after Dana verifies the fix, not when the owner says it is done. Last month the agency reported the booking chain fixed, but Dana's retest still showed the intermediate missing on one of two load-balanced servers. Tracking with verification catches such half-fixes, and the history shows the client how long issues stay open, which is useful when discussing service levels.

6.3 Handing off fixes

Dana rarely fixes things herself. Certificate renewals on the booking site go to the agency, laptop encryption issues go to Copperleaf's desktop team, and payment integration settings go to the clinic manager, who contacts the processor. Each handoff includes the finding, the evidence, a suggested fix with a reference such as the relevant RFC or NIST page, and the deadline. Marcus teaches her to propose rather than order: a supplier who understands why a change matters will usually act faster than one handed an unexplained demand.

Worked example

Dana completes a monthly run for Bayside, finds a half-fixed chain on one load-balanced server, keeps the finding open and hands it back to the agency with evidence.

Synthetic case. Tracker entries and the agency exchange are synthetic; RFC 6962 is real.

Errors and limits

Monthly cycles miss short-lived problems between runs. Transparency logs cover public CAs only.

Exercises

Synthesis

A repeatable workflow with verified closure and clear handoffs turns monthly checks into lasting improvements.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →