Chapter 6 — Security architecture and engineering: operational workflow
Lesson map
Lesson 06 published. Map, example, EX026.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Working with existing processes"]
N2["6.2 Contractor access workflow"]
N3["6.3 Reducing manual effort"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX026"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Working with existing processes"]
N2["6.2 Contractor access workflow"]
N3["6.3 Reducing manual effort"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX026"]
[Learning outcomes]
|
v
[6.1 Working with existing processes]
|
v
[6.2 Contractor access workflow]
|
v
[6.3 Reducing manual effort]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX026]
Learning outcomes
You will (1) fit security checks into existing workflows; (2) design a contractor access workflow; (3) reduce manual effort.
6.1 Working with existing processes
Thornbury already has processes for onboarding contractors, raising IT changes and handling complaints. Owen adds security steps to these rather than creating separate ones. Contractor onboarding gains a step to agree data handling rules and named accounts. IT changes gain three security questions. Complaints that mention data handling are copied to the data protection officer. Ines notes that security steps woven into familiar workflows get done far more reliably than separate security procedures that people must remember to follow. Owen agrees each change with the process owner first.
6.2 Contractor access workflow
For the threat of former contractor employees, Owen designs a workflow. Contractors request accounts for named staff through the supplier portal; the property team approves; accounts expire after ninety days unless renewed; and contractors must report leavers within two working days, which is written into contracts. Each month, the property team receives a list of accounts not used for thirty days and confirms whether to keep them. The workflow ends shared logins and gives Thornbury a clear record of who can see tenant jobs.
6.3 Reducing manual effort
Owen asks the supplier portal vendor whether expiry and unused-account reports can be automated. They can, through existing settings. He also arranges for key safe codes to appear only on the assigned contractor's job and only for the visit day. The property team's monthly check now takes fifteen minutes. He measures the change: active contractor accounts fall from two hundred and ten to one hundred and thirty-five after the first review. Less manual work makes the workflow sustainable for a busy team.
Worked example
Owen adds security steps to existing processes, designs an expiring contractor access workflow and automates reports, reducing accounts from 210 to 135.
Synthetic case. Processes and figures are synthetic.
Errors and limits
Contract clauses depend on enforcement. Automated expiry can lock out active staff.
Exercises
- EX026 — Woven steps. Why add steps to existing processes? Rubric: 3 = they get done more reliably than separate procedures;; 2 = reliability;; 1 = vague;; 0 = none.
- EX027 — Expiry period. When do contractor accounts expire? Rubric: 3 = after ninety days unless renewed;; 2 = ninety days;; 1 = never;; 0 = none.
- EX028 — Key code change. How were key safe codes restricted? Rubric: 3 = only for the assigned contractor and visit day;; 2 = assigned;; 1 = vague;; 0 = none.
- EX029 — Account reduction. How did active contractor accounts change? Rubric: 3 = from 210 to 135;; 2 = fell;; 1 = vague;; 0 = none.
- EX030 — Leaver reporting. How fast must contractors report leavers? Rubric: 3 = within two working days, written into contracts;; 2 = two days;; 1 = vague;; 0 = none.
Synthesis
Security works best woven into existing workflows, with automation keeping the effort sustainable.
Continue studying — chapter 06 of 12
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →