◇ OpenCyber Academy
Professional · Chapter 9 · English

Chapter 9 — Communication, ethics and reporting

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Report structure"]
  N2["9.2 Facts, inferences, recommendations"]
  N3["9.3 Ethics in practice"]
  N4["9.4 Fairness to the user"]
  N5["9.5 Personal data in reports"]
  N6["9.6 Plain language"]
  N7["9.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Report structure"]
  N2["9.2 Facts, inferences, recommendations"]
  N3["9.3 Ethics in practice"]
  N4["9.4 Fairness to the user"]
  N5["9.5 Personal data in reports"]
  N6["9.6 Plain language"]
  N7["9.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Report structure]
    |
    v
[9.2 Facts, inferences, recommendations]
    |
    v
[9.3 Ethics in practice]
    |
    v
[9.4 Fairness to the user]
    |
    v
[9.5 Personal data in reports]
    |
    v
[9.6 Plain language]
    |
    v
[9.7 Review]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write a clear incident report; (2) separate facts, inferences and recommendations; (3) apply ethical limits to investigation; (4) handle personal data responsibly.

9.1 Report structure

Summary; scope and authority; timeline; findings with confidence; impact; actions taken; recommendations; limits; appendices with evidence list and manifest. Casey (2011) stresses that reports must let others check how conclusions were reached. For Marlow, the timeline carries the five events from 09:10 to 10:05, the findings carry confidence levels such as 'high' for unauthorised access and 'unknown' for who was behind it, and the limits name the 09:14–09:40 gap. The appendices hold the manifest, custody log and verification table, and the restricted appendix holds the forwarded subjects for the data protection lead.

9.2 Facts, inferences, recommendations

Fact: "A sign-in from 203.0.113.50 succeeded at 09:14." Inference: "This was not Joy." Recommendation: "Remove the MFA exemption group." Each is labelled so readers know its status. Mixing these is the most common reporting fault: a recommendation dressed as a fact sounds settled, and an inference written as fact hides its reasoning. The inference 'this was not Joy' rests on the new address, her statement and the 09:10 visit, and the report says so. A reader who disagrees can then challenge the reasoning without disputing the records.

9.3 Ethics in practice

During analysis Lena sees personal messages in Joy's mailbox. She does not read beyond what the question needs, does not mention them, and lists only subjects relevant to the incident. Investigation powers are for the incident, not curiosity. The limit is set by the questions, not by what the console allows. Lena's admin access could open any message in Joy's mailbox, but her questions need only the rule list, the trace and audit records. The eleven forwarded messages are listed by subject; Joy's personal mail is neither listed nor discussed with colleagues.

9.4 Fairness to the user

Joy made a mistake many people make. The report describes the phishing page's quality and the missing controls, not Joy's character. Blame discourages reporting. The look-alike page used a domain registered two days earlier, new enough that the mail filter did not flag it, and it was dressed as a shared-invoice login. Joy's account also lacked MFA because of an old exemption group she did not choose. The report states that she clicked, and also that her account of the morning helped confirm the unauthorised sign-in, so staff reading it see that reporting helps.

9.5 Personal data in reports

Names appear only where needed; the forwarded subjects list goes in a restricted appendix for the data protection lead. The main report refers to 'an accounts clerk' and uses Joy's name only where the timeline needs the account j.okafor. Supplier contact names from the forwarded mail appear nowhere in the main text. The restricted appendix lists the eleven subjects for the data protection lead, who decides what notification, if any, is needed. Wider readers such as managers receive the report without that appendix.

9.6 Plain language

Short sentences, defined terms, times with zones, no unexplained jargon. Lena's summary shows the style: 'an attacker used a password captured by a fake login page', not jargon about credential harvesting. Terms like 'inbox rule' and 'message trace' are explained the first time they appear. Every time carries a zone, as in 'access was removed at 10:05 UTC'. Managers and finance readers need to act on the report, so a sentence that only security staff understand fails its purpose even if it is accurate.

9.7 Review

Dev reviews and signs the report before distribution. Dev checks that every finding cites a record, that the confidence wording matches the evidence and that the limits name the 09:14–09:40 gap. He also checks the language for blame and for personal data outside the restricted appendix. His signature means the security team stands behind the report, not just Lena. Changes he asks for are made in a new version, and earlier drafts are kept with the case so the edits can be traced.

External notices

Messages to Kestrel and to staff are shorter than the report and contain no technical detail beyond what each reader can act on.

Worked example

Lena's summary: "On 3 March 2026 an attacker used a password captured by a fake login page to access one accounts mailbox for 51 minutes. They forwarded 11 messages outside the company by 10:05 (the 10:05–10:15 window, while the rule remained active, is being checked) and sent one fake bank-change request to a supplier, which the supplier checked by phone; no payment changed. Access was removed at 10:05 UTC. Three control gaps are being fixed."

Synthetic case. The report text is invented.

Errors and limits

A report reflects evidence available at the time; note that conclusions may change with new information.

Exercises

Synthesis

Report clearly with labelled statements, act ethically with personal data and focus on causes, not blame.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →