Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The practitioner setting"]
N2["1.2 Goals in practice"]
N3["1.3 What practitioners do"]
N4["1.4 Working approach"]
N5["1.5 Sources of guidance"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The practitioner setting"]
N2["1.2 Goals in practice"]
N3["1.3 What practitioners do"]
N4["1.4 Working approach"]
N5["1.5 Sources of guidance"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The practitioner setting]
|
v
[1.2 Goals in practice]
|
v
[1.3 What practitioners do]
|
v
[1.4 Working approach]
|
v
[1.5 Sources of guidance]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) state core security goals in practice; (2) describe the practitioner's role; (3) set up a working approach for the course.
1.1 The practitioner setting
Grace Whitfield has worked for eight years in IT support and joins a six-month professional course at the fictional Northgate Professional Academy to move into network security. Her mentor is Sam Adeyemi, a senior network engineer. The course uses a running case: the fictional Oakline Legal, a law firm with three offices, 140 staff, client case files that must stay confidential and a small IT team that has asked for help reviewing its network security. Grace's work is supervised and uses synthetic data in labs, with any real-system activity approved in advance.
1.2 Goals in practice
Confidentiality, integrity and availability take concrete forms at a law firm. Confidentiality means case files are seen only by the lawyers working on them and never by guests or other clients. Integrity means documents and emails are not altered, since altered evidence or instructions could harm a case. Availability means lawyers can reach files and email before court deadlines. Grace learns to express every security task in these terms, because managers and partners understand business consequences more readily than technical descriptions of protocols and ports.
1.3 What practitioners do
Network security practitioners review designs and rule changes, monitor alerts and logs, investigate unusual activity, maintain secure configurations and explain risks to others. Much of the work is routine: checking that changes are safe, that certificates are current and that alerts are handled. Some is reactive, such as investigating a suspicious login. Grace notes that her support background helps: she already understands users, tickets and the cost of disruption, which are central to doing security work that people accept. She records which tasks are routine and which reactive.
1.4 Working approach
Sam sets out a working approach for the course. Every task starts by confirming scope and authorisation, uses evidence rather than assumptions, makes the smallest effective change, verifies the result and records what was done. Grace keeps a practice log of tasks, decisions and lessons, which becomes part of her final portfolio. The approach is simple, but following it consistently prevents most of the mistakes that cause security work to disrupt services or miss real problems. Sam checks her log weekly and comments on each decision, which keeps the approach honest.
1.5 Sources of guidance
Practitioners rely on trusted guidance rather than opinion. Grace's reference list includes NIST SP 800-41r1 for firewall policy, SP 800-94 for intrusion detection, SP 800-77r1 for IPsec VPNs, SP 800-52r2 for TLS, SP 800-153 for wireless and the CIS Controls for prioritised safeguards. She learns to cite the specific guidance behind a recommendation, which makes recommendations easier to accept and to check, and protects her from appearing to impose personal preferences on an experienced IT team. She keeps the documents in a shared folder for quick reference.
Worked example
Grace's first log entry records the Oakline scope, her approach and the five guidance documents she will use.
Synthetic case. Oakline Legal and all data are synthetic.
Errors and limits
Describing risks only in technical terms makes it harder for managers to act.
Exercises
- EX001 — Law firm integrity. Give an integrity concern specific to a law firm. Rubric: 3 = altered documents or instructions harming a case;; 2 = altered files;; 1 = generic;; 0 = none.
- EX002 — Approach steps. List the five steps of Sam's working approach. Rubric: 3 = scope, evidence, smallest change, verify, record;; 2 = four;; 1 = fewer;; 0 = none.
- EX003 — Support background value. How does Grace's support background help? Rubric: 3 = understands users, tickets and disruption cost;; 2 = users;; 1 = vague;; 0 = none.
- EX004 — Citing guidance. Why cite specific guidance for recommendations? Rubric: 3 = easier to accept and check, not personal preference;; 2 = credibility;; 1 = required;; 0 = none.
- EX005 — Availability example. Give an availability need at Oakline. Rubric: 3 = reaching files and email before court deadlines;; 2 = deadlines;; 1 = generic;; 0 = none.
Synthesis
Practitioners translate security goals into business terms and follow a consistent, evidence-based approach.