Chapter 6 — Network and communications security: operational workflow | Professional Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Network and communications security: operational workflow

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Daily routine"]
  N2["6.2 Weekly routine"]
  N3["6.3 Ticket workflow"]
  N4["6.4 Escalation"]
  N5["6.5 Handover between shifts"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Daily routine"]
  N2["6.2 Weekly routine"]
  N3["6.3 Ticket workflow"]
  N4["6.4 Escalation"]
  N5["6.5 Handover between shifts"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 Daily routine]
    |
    v
[6.2 Weekly routine]
    |
    v
[6.3 Ticket workflow]
    |
    v
[6.4 Escalation]
    |
    v
[6.5 Handover between shifts]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) run daily and weekly security routines; (2) manage tickets; (3) escalate appropriately.

6.1 Daily routine

Grace drafts a daily routine for Oakline's IT team: review overnight high-priority alerts, check that VPN tunnels between offices are up, confirm logs arrived from each firewall and glance at the help desk queue for access problems that might signal blocked needs or misuse. The routine takes about fifteen minutes. A short, fixed routine ensures important signals are seen every day, even when the team is busy with other work. Anything unusual becomes a ticket so it is tracked to completion rather than remembered informally.

6.2 Weekly routine

Weekly tasks include reviewing denied connections by network pair, checking certificates expiring within sixty days, reviewing temporary rules approaching expiry, and checking accounts for leavers. Grace builds a checklist with expected times and a place to record results. Records show that checks happened and make trends visible over weeks. A weekly routine catches slower problems, such as gradually rising denies, that daily glances miss. The checklist is kept in the ticket system so that missed weeks are visible to Priyanka, and results from previous weeks can be compared easily.

6.3 Ticket workflow

Security work at Oakline flows through the help desk system. Grace defines ticket categories: alert investigation, rule change request, access request and security question. Each category has a target response time and an owner. Alert investigations record what was checked, the conclusion and any follow-up. Using the existing ticket system rather than a separate tool keeps work visible to the whole IT team and fits how they already work. Priyanka reviews overdue security tickets every Friday, so investigations do not quietly stall.

6.4 Escalation

Some situations need more than routine handling. Grace writes escalation criteria: suspected compromise of an account with access to case files, evidence of data leaving the firm, or loss of service affecting court deadlines. Escalation goes to the IT manager and, for confidentiality incidents, the compliance officer, who decides on client and regulatory notifications. Clear criteria prevent both delay, when people hesitate to escalate, and panic, when everything is treated as an emergency. The criteria are printed beside the IT team's desks and included in the daily routine.

6.5 Handover between shifts

Oakline's IT team works staggered hours. Grace adds a short handover note at the end of each day: open investigations, changes made and anything to watch. Handover notes prevent issues falling between people and reduce repeated work. They are kept in the ticket system so they remain searchable. Small habits like handover notes make a team's security work reliable without adding significant effort. Grace provides a three-line template: open items, changes made today and things to watch tomorrow. The template keeps notes short enough that people actually write them.

Worked example

The daily routine takes fifteen minutes; the weekly checklist has four items; three escalation criteria are agreed.

Synthetic case. Routines are synthetic.

Errors and limits

Without escalation criteria, serious events wait in the routine queue.

Exercises

EX026 — Daily checks. List three daily routine checks. Rubric: 3 = alerts, tunnels, log arrival or help desk queue;; 2 = two;; 1 = one;; 0 = none.
EX027 — Weekly value. What do weekly checks catch that daily ones miss? Rubric: 3 = slow trends like rising denies;; 2 = trends;; 1 = vague;; 0 = none.
EX028 — Ticket system reuse. Why use the existing ticket system? Rubric: 3 = keeps work visible and fits current practice;; 2 = visibility;; 1 = cheaper;; 0 = none.
EX029 — Escalation criterion. Give one escalation criterion. Rubric: 3 = suspected compromise of case-file account, data leaving, deadline outage;; 2 = one;; 1 = vague;; 0 = none.
EX030 — Compliance role. Who decides on client and regulatory notifications? Rubric: 3 = compliance officer;; 2 = compliance;; 1 = IT;; 0 = none.

Synthesis

Short routines, a clear ticket workflow and defined escalation make security operations dependable.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →