Chapter 2 — Network and communications security: service and stakeholder context | Professional Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Network and communications security: service and stakeholder context

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Services and users"]
  N2["2.2 Stakeholders"]
  N3["2.3 Client confidentiality"]
  N4["2.4 Prioritising in context"]
  N5["2.5 Recording context"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Services and users"]
  N2["2.2 Stakeholders"]
  N3["2.3 Client confidentiality"]
  N4["2.4 Prioritising in context"]
  N5["2.5 Recording context"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Services and users]
    |
    v
[2.2 Stakeholders]
    |
    v
[2.3 Client confidentiality]
    |
    v
[2.4 Prioritising in context]
    |
    v
[2.5 Recording context]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) map Oakline's services and users; (2) identify stakeholders and their concerns; (3) prioritise risks in context.

2.1 Services and users

Grace maps Oakline's services with the IT team: a document management system holding case files, email in the cloud, a practice management system for billing, printing and scanning, guest wireless in reception and meeting rooms, and a VPN for lawyers working from home or court. Each office has a firewall, and the offices connect by site-to-site VPN. She lists which user groups use each service: lawyers, support staff, finance, IT and guests. This map becomes the basis for every later check.

2.2 Stakeholders

Different people care about different things. Partners care about client confidentiality and reputation. Lawyers care about fast access, especially near deadlines. The finance director cares about billing systems and cost. The IT manager, Priyanka Shah, cares about workload and reliability. The compliance officer cares about regulatory obligations and evidence. Grace meets each briefly, asking what would be the worst outcome for them. Their answers shape her priorities and help her explain recommendations in terms each stakeholder values. She records each answer in her practice log.

2.3 Client confidentiality

Law firms hold information that clients trust them to protect, and some matters are highly sensitive. Oakline already restricts some case files to named lawyers inside the document system. Grace checks whether the network supports this: can guest devices reach the document system, can any office device reach its management interface, and are connections encrypted? She finds that guest wireless at one office shares a network with printers that are also used for confidential documents, a gap she records for review.

2.4 Prioritising in context

Grace ranks risks by likelihood and impact in Oakline's context. Guest access near confidential printing is likely and serious, so it ranks high. Weak VPN authentication for lawyers working remotely ranks high because remote access is a common target. Outdated printer firmware ranks medium. She discusses the ranking with Priyanka, who adds that the firm's insurer has asked about multi-factor authentication, raising its priority further. Context changes priorities, so rankings must be agreed with people who know the business. The agreed ranking is dated and filed.

2.5 Recording context

Grace writes a two-page context summary: services, users, stakeholders, constraints and the top five risks. Constraints include a small IT team, busy periods before court dates and a requirement that changes avoid working hours. The summary is reviewed by Priyanka and Sam. Writing context down keeps later work focused and lets others check that recommendations fit the firm. It also helps when new people join the work, because they can understand the setting quickly. The summary is updated whenever services, stakeholders or constraints change during the engagement.

Worked example

The context summary lists six services, five stakeholder groups, three constraints and five ranked risks.

Synthetic case. The firm and people are synthetic.

Errors and limits

Ranking risks without the business's input misses factors such as insurer requirements.

Exercises

EX006 — Worst outcome question. What did Grace ask each stakeholder? Rubric: 3 = the worst outcome for them;; 2 = worst case;; 1 = their job;; 0 = none.
EX007 — Printer gap. What gap did Grace find at one office? Rubric: 3 = guest wireless shares network with confidential printers;; 2 = guest-printer;; 1 = vague;; 0 = none.
EX008 — Insurer effect. How did the insurer affect priorities? Rubric: 3 = asked about MFA, raising its priority;; 2 = MFA up;; 1 = vague;; 0 = none.
EX009 — Change constraint. Name one constraint on changes at Oakline. Rubric: 3 = avoid working hours or busy court periods;; 2 = one;; 1 = vague;; 0 = none.
EX010 — Context summary purpose. Why write the context summary down? Rubric: 3 = focus, checking fit, onboarding others;; 2 = focus;; 1 = formality;; 0 = none.

Synthesis

Understanding services, stakeholders and constraints grounds network security work in the organisation's needs.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →