OpenCyber AcademyLearning outcomes
You will (1) describe what the six-month professional course covers; (2) meet the running case; (3) agree the ground rules for working with a real employer.
1.1 The learner
Daniel Reyes is an office manager who has been asked to take on information security at his employer alongside his existing job. He enrols on a six-month professional course at the fictional Kingsmere Professional Institute, studying two evenings a week. His tutor, Ms. Helen Ashby, spent fifteen years running security for mid-sized firms before teaching. She tells the group that most of them will be the only person in their organisation with security in their title, so the course focuses on judgement, priorities and clear communication rather than deep technical skill.
1.2 The employer
Daniel works at the fictional Corbridge Accountancy Partners, a firm of eight partners and about sixty staff in two offices. The firm holds tax returns, payroll files, bank statements and identity documents for around two thousand clients. Email, files and accounting software all run in cloud services, with a small file server kept in the main office for older records. An outside support company handles devices. Daniel reports to the managing partner, Mrs. Joanna Pike, who wants a plain answer to one question: are we doing the right things, and what should we do next?
1.3 How the course runs
The twelve chapters move from understanding the firm and its risks, through accounts, devices, email, suppliers and people, to incidents, continuity, policy, measurement and reporting to leadership. Each chapter ends with a task Daniel applies at Corbridge, and Ms. Ashby reviews the results in a short weekly call. Two labs use small Python scripts on synthetic data: one measures multi-factor sign-in coverage and one ranks a risk register. Daniel has never written code, so Ms. Ashby explains that he only needs to read and run the scripts, not write them from scratch.
1.4 Ground rules
Ms. Ashby sets three rules. First, get written agreement from Mrs. Pike before checking any system, even one Daniel already uses daily. Second, never copy real client data into coursework; describe it or use synthetic examples. Third, record every finding with the date, evidence and the person told, so a colleague could follow the trail later. Daniel writes a one-page scope note listing what he may look at, and Mrs. Pike signs it. Ms. Ashby explains that the note protects Daniel if anyone later asks why he was looking at settings outside his usual job.
Worked example
Daniel joins the professional course, meets Corbridge's sixty staff and two thousand clients, and gets a signed scope note before checking anything.
Synthetic case. Kingsmere, Corbridge and all people are synthetic.
Errors and limits
Checking systems without written agreement can damage trust even when the intention is good.
Exercises
- EX001 — Course length. How long is Daniel's course?
Show marking criteria
Rubric: 3 = six months;; 2 = partly correct;; 1 = wrong;; 0 = none. - EX002 — Client records. Roughly how many clients does Corbridge hold records for?
Show marking criteria
Rubric: 3 = about two thousand;; 2 = partly correct;; 1 = wrong;; 0 = none. - EX003 — Leadership question. What does Mrs. Pike want answered?
Show marking criteria
Rubric: 3 = are we doing the right things, what next;; 2 = both parts;; 1 = one part;; 0 = none. - EX004 — Scope note. Why does Daniel get a signed scope note?
Show marking criteria
Rubric: 3 = written agreement before checking;; 2 = partly correct;; 1 = vague;; 0 = none. - EX005 — Coding needed. Does Daniel need to write the lab scripts?
Show marking criteria
Rubric: 3 = no, read and run them;; 2 = partly correct;; 1 = wrong;; 0 = none.