Chapter 3 — Authorized practice and evidence handling

Chapter 3 — Authorized practice and evidence handling

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Authorisation"]
  N2["3.2 Handling evidence"]
  N3["3.3 Protecting privacy"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Authorisation"]
  N2["3.2 Handling evidence"]
  N3["3.3 Protecting privacy"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Authorisation]
    |
    v
[3.2 Handling evidence]
    |
    v
[3.3 Protecting privacy]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) work within written authorisation; (2) handle evidence from reports safely; (3) protect privacy in security work.

3.1 Authorisation

Alan explains that security coordinators must act within written authorisation. Grace obtains a short mandate from Ferngate's chief executive describing what she may do: manage the reporting mailbox, review reported messages with the IT supplier, run learning sessions and review verification logs. It states what she may not do: read staff mailboxes, monitor individuals or run deceptive tests without approval from managers and staff representatives. Authorisation protects Grace, colleagues and Ferngate by making boundaries clear before any problem arises. She keeps a signed copy.

3.2 Handling evidence

Reported messages are evidence of attacks. Grace learns to handle them safely: never click links or open attachments from reports on her normal computer; forward suspicious items to the IT supplier using the agreed method; record the date, type and outcome without copying personal details; and keep records in a restricted folder. If a report suggests a serious incident, such as a tenant data leak, she follows the incident plan and preserves information as the IT supplier advises, rather than investigating alone.

3.3 Protecting privacy

Reports sometimes contain tenant details or personal messages. Grace removes personal details from summaries and keeps original reports only as long as needed. She does not record who reported what in any summary shared with managers. She explains to managers that this protects tenants' privacy and encourages staff to report without fear of being judged. Privacy protection is part of authorised practice, because security work must not create new harms while trying to prevent others. Managers agree with this approach. Alan agrees.

Worked example

Grace obtains a mandate with clear limits, handles reported messages safely and removes personal details from summaries.

Synthetic case. The mandate is synthetic.

Errors and limits

Mandates need updating. Evidence handling needs supplier support.

Exercises

• EX011 — Mandate limit. Name one thing Grace may not do. Rubric: 3 = read staff mailboxes;; 2 = monitoring;; 1 = review reports;; 0 = none.
• EX012 — Safe handling. What must Grace never do with reported items? Rubric: 3 = click links or open attachments on her computer;; 2 = no clicking;; 1 = vague;; 0 = none.
• EX013 — Serious incident. What does Grace do if a report suggests a serious incident? Rubric: 3 = follow the incident plan and supplier advice;; 2 = plan;; 1 = investigate alone;; 0 = none.
• EX014 — Summary rule. What is excluded from summaries for managers? Rubric: 3 = who reported what;; 2 = reporter identity;; 1 = vague;; 0 = none.
• EX015 — Privacy reason. Why does privacy encourage reporting? Rubric: 3 = staff do not fear being judged;; 2 = trust;; 1 = vague;; 0 = none.

Synthesis

Authorised practice sets boundaries, handles evidence safely and protects privacy.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →