## Chapter 1 — Security foundations for practitioners ### Learning outcomes You will (1) state the core goals of security in practical terms; (2) apply them to a housing association's services; (3) recognise the limits of a short course. ### 1.1 Starting point Owen Hartley is a project manager moving into security architecture through a six-month professional course at the fictional Meridian Professional Academy. His coach is Ines Carvalho. He works for the fictional Thornbury Housing Association, which manages four thousand rented homes and runs a tenant portal, a repairs system, a rent payment service and a call centre. Ines asks him to describe security in his own words. Owen settles on keeping tenant information private, keeping records correct and keeping services running, which matches confidentiality, integrity and availability. ### 1.2 Applying the goals Owen applies the three goals to Thornbury. Confidentiality matters most for tenant files, which include benefit details, health needs and safeguarding notes about vulnerable residents. Integrity matters for rent accounts, because a wrong balance could lead to wrongful arrears letters. Availability matters for the repairs system, because a broken boiler in winter cannot wait. Mapping goals to real services helps him explain to colleagues why security is not an IT preference but a way of protecting tenants from concrete harms that they would recognise immediately. ### 1.3 Limits of a short course Ines is honest about the course: six months will make Owen a capable practitioner who can apply methods, read evidence and work with specialists, not an expert in every area. He will learn when to ask for help, for example on cryptography, cloud configuration or legal questions. Anderson (2020) emphasises that security engineering spans many disciplines, so knowing where one's competence ends is part of professional practice. Owen writes a short list of topics he will refer to specialists, which he plans to revisit as his experience grows. ### Worked example Owen defines the three security goals in plain terms, maps each to a Thornbury service and lists topics he will refer to specialists. > **Synthetic case.** Thornbury, Meridian and all people are synthetic; Anderson (2020) is real. ### Errors and limits Plain-language definitions simplify. Referral lists must be revisited as skills grow. ### Exercises - **EX001 — Owen's definition.** How did Owen describe security in his own words? *Rubric:* 3 = keep tenant information private, records correct and services running;; 2 = three parts;; 1 = vague;; 0 = none. - **EX002 — Integrity example.** Why does integrity matter for rent accounts? *Rubric:* 3 = a wrong balance could cause wrongful arrears letters;; 2 = arrears;; 1 = vague;; 0 = none. - **EX003 — Availability example.** Which service shows availability's importance? *Rubric:* 3 = repairs, such as a broken boiler in winter;; 2 = repairs;; 1 = portal;; 0 = none. - **EX004 — Course limit.** What will the course make Owen? *Rubric:* 3 = a capable practitioner who knows when to ask specialists;; 2 = practitioner;; 1 = expert;; 0 = none. - **EX005 — Specialist topics.** Name one topic Owen will refer to specialists. *Rubric:* 3 = cryptography, cloud configuration or legal questions;; 2 = one;; 1 = vague;; 0 = none. ### Synthesis Practitioners start by tying security goals to real services and knowing the limits of their competence. ### Continue studying — chapter 01 of 12 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Keeping tenant information private, records correct and services running. **EX002.** Because a wrong balance could lead to wrongful arrears letters. **EX003.** The repairs system, since a broken boiler in winter cannot wait. **EX004.** A capable practitioner who can apply methods and knows when to refer to specialists. **EX005.** Cryptography, cloud configuration or legal questions, such as data protection law.