◇ OpenCyber Academy
Professional · Chapter 11 · English

Chapter 11 — Supervised laboratory

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Supervised laboratory

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Setup"]
  N2["11.2 Tasks"]
  N3["11.3 The incident"]
  N4["11.4 Assessment"]
  N5["11.6 Practice task"]
  N6["11.7 Reflection"]
  N7["11.8 Working with simulated stakeholders"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Setup"]
  N2["11.2 Tasks"]
  N3["11.3 The incident"]
  N4["11.4 Assessment"]
  N5["11.6 Practice task"]
  N6["11.7 Reflection"]
  N7["11.8 Working with simulated stakeholders"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Setup]
    |
    v
[11.2 Tasks]
    |
    v
[11.3 The incident]
    |
    v
[11.4 Assessment]
    |
    v
[11.6 Practice task]
    |
    v
[11.7 Reflection]
    |
    v
[11.8 Working with simulated stakeholders]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) run a full workflow cycle on a synthetic dataset; (2) produce tracker, findings and report; (3) work with simulated owners and suppliers; (4) handle a simulated incident; and (5) reflect on performance.

11.1 Setup

The lab uses a synthetic MTI dataset: 40 assets with configuration exports, a few log summaries, supplier questionnaire answers and data-lifetime records. Your supervisor and peers play owners, suppliers and the sponsor. No real systems or data are involved.

Treat the dataset as you would real evidence: request simulated authorization before using it, label it and grade each item. The supervisor checks handling as well as results. Ask questions of the role-players as you would of real owners, and record their answers as evidence.

11.2 Tasks

Day 1: scope, authorization (simulated), inventory and grading. Day 2: prioritisation with Mosca's rule and exposure classes. Day 3: plan items, send supplier requests, raise findings. Day 4: a simulated rollout with gate results and one incident (silent fallback). Day 5: quarterly report and presentation.

Keep outputs from each day, since the next day builds on them. At the end of each day, check that the tracker reflects what you learned. The Day 5 report should draw only on outputs from earlier days, so anything missing will show. If you fall behind, tell the supervisor and agree what to drop, as you would with a real sponsor.

11.3 The incident

Mid-lab, the "platform owner" reports that the quote API's hybrid share dropped after an update. You coordinate: tracker update, owner engagement, communication to stakeholders, lessons.

Treat it as a real incident. Move the item from Verified to In progress or blocked with a reason, contact the owner, tell stakeholders what changed and when the next update will come, and leave diagnosis to the platform owner. Record a lesson afterwards, as MTI did after the broker portal regression. Keep the timeline.

11.4 Assessment

Supervisors assess accuracy of the inventory and priorities, quality of findings and evidence handling, tracker integrity, communication, and handling of the incident.

Each criterion maps to a chapter of the book, so feedback tells you which chapter to revisit. Supervisors look at evidence for every claim you make; an accurate tracker with honest unknowns scores better than a tidy one with unsupported Verified items. Ask for written feedback at the end of each day. Act on it the next day.

11.5 Worked example

A participant's Day 2 output: 9 tier-1 assets; priority list headed by archive transfers and reinsurer SFTP; 6 unknowns with tasks; Mosca table across z = 10, 15, 20. Supervisor feedback: one supplier claim graded as B should be D; corrected and the priority of that asset reduced pending verification.

The feedback shows why grading matters: the misgraded claim had raised an asset's priority on a supplier's word. Correcting it moved money and attention to items with better evidence. The participant recorded the correction in the daily log.

11.6 Practice task

Complete the five-day lab and keep a short daily log.

Each day, write what you produced, what decision you made and why, and what you would do differently. Keep the log factual and short. Note when a role-player's answer changed your plan. The log feeds the reflection and becomes part of your portfolio. Read the log each morning before starting, so yesterday's lessons shape today's work. Share it with your supervisor at the end of the week. At MTI, the log is the first evidence your supervisor reads when signing off the lab.

11.7 Reflection

At the end, write a one-page reflection: what you did well, what you would change, which skill needs more practice, and one improvement to the workflow itself. Share it with your supervisor.

Base the reflection on the daily log and the supervisor's feedback rather than memory. Be specific: "I graded a supplier claim as B" is more useful than "grading needs work". Choose one improvement to the workflow that you could propose at MTI, such as a rule for re-checking Verified items, and explain how you would test whether it helped.

11.8 Working with simulated stakeholders

Treat role-players as real: send clear, polite requests with deadlines; record answers; escalate when deadlines pass. The lab assesses whether you can keep a workflow moving through other people, which is the core of the practitioner's job.

If a role-player refuses a deadline, record it and offer options, as you would with a real owner. The supervisor watches whether your requests are clear enough to act on without a follow-up question, whether you record answers as evidence, and whether escalation is timely and polite rather than abrupt.

11.9 Common errors and limits

Each error misses what the lab tests. Treating it as a spreadsheet exercise ignores the people who must act on your requests. Missing the incident's communication step leaves stakeholders unaware of a regression, which damages trust more than the regression itself. Skipping the reflection loses the lesson that the supervisor's feedback was meant to produce. Check your own lab work for all three. Note what you changed.

Exercises

Synthesis

The supervised lab runs a complete cycle with simulated people and an incident, building confidence in the workflow before real use.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →