Chapter 9 — Communication, ethics and reporting | Professional Cryptography and trust services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Report structure"]
  N2["9.2 Consistent ratings"]
  N3["9.3 Ethics in practice"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Report structure"]
  N2["9.2 Consistent ratings"]
  N3["9.3 Ethics in practice"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Report structure]
    |
    v
[9.2 Consistent ratings]
    |
    v
[9.3 Ethics in practice]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) structure a cryptographic findings report; (2) rate risk consistently; (3) apply professional ethics to disclosure and honesty.

9.1 Report structure

Copperleaf's monthly report for Bayside has four parts. An executive summary of half a page says what matters most and what the client should decide. A findings table lists each item with identifier, plain description, risk rating, owner and due date. Technical appendices hold commands, outputs and references for the agency and the desktop team. A closing section lists what was not checked. Dana learns to write the summary last, after the findings are confirmed, and to lead with the action needed rather than the history of the investigation, because the clinic manager reads only the first page.

9.2 Consistent ratings

Risk ratings must mean the same thing every month. Copperleaf rates by likelihood and impact on a three-point scale each, combined into low, medium or high. An expired public certificate is likely to be noticed and harms bookings, so it is high. An RSA-1024 key on an internal server reachable only by staff is medium: the weakness is real and should be fixed, but exploitation needs network access first. Dana writes a sentence of justification for every rating. When Marcus reviews her work, he checks that similar findings across clients received similar ratings, which keeps the service fair and defensible.

9.3 Ethics in practice

Ethics shows up in small choices. Dana discovers that the agency's own website, outside her scope, shows the same chain error; she does not test it further but mentions it informally to the agency contact. When a finding is embarrassing because Copperleaf itself configured the setting, she reports it like any other. She never overstates risk to sell more services, and never understates it to avoid an awkward meeting. If she ever found a flaw in a supplier's product affecting many customers, she would follow coordinated disclosure through Copperleaf, not post it publicly. Honest reporting is what clients pay for.

Worked example

Dana writes a Bayside monthly report with a half-page summary, a rated findings table with justifications and an appendix, including one finding caused by Copperleaf.

Synthetic case. The report, ratings and agency website are synthetic.

Errors and limits

Three-point scales hide nuance; justifications carry the detail. Informal notes about out-of-scope issues must not become unauthorised testing.

Exercises

EX041 — Summary placement. Why write the executive summary last? Rubric: 3 = findings must be confirmed first and the summary leads with action;; 2 = confirmed;; 1 = first;; 0 = none.
EX042 — Internal RSA-1024 rating. Why is the internal RSA-1024 key rated medium rather than high? Rubric: 3 = real weakness but exploitation needs internal network access;; 2 = access needed;; 1 = rated low;; 0 = none.
EX043 — Cross-client check. What does Marcus check across clients' ratings? Rubric: 3 = similar findings received similar ratings;; 2 = consistency;; 1 = vague;; 0 = none.
EX044 — Own mistake. How should Dana report a weakness Copperleaf itself introduced? Rubric: 3 = exactly like any other finding, without hiding it;; 2 = report;; 1 = hide it;; 0 = none.
EX045 — Supplier product flaw. What should happen if Dana finds a flaw in a widely used supplier product? Rubric: 3 = coordinated disclosure through Copperleaf, not public posting;; 2 = disclosure;; 1 = post publicly;; 0 = none.

Synthesis

Clear structure, consistent ratings and honest ethics make cryptographic reports trustworthy and actionable.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →