OpenCyber AcademyLearning outcomes
You will (1) state the core goals of security in practical terms; (2) apply them to a housing association's services; (3) recognise the limits of a short course.
1.1 Starting point
Owen Hartley is a project manager moving into security architecture through a six-month professional course at the fictional Meridian Professional Academy. His coach is Ines Carvalho. He works for the fictional Thornbury Housing Association, which manages four thousand rented homes and runs a tenant portal, a repairs system, a rent payment service and a call centre. Ines asks him to describe security in his own words. Owen settles on keeping tenant information private, keeping records correct and keeping services running, which matches confidentiality, integrity and availability.
1.2 Applying the goals
Owen applies the three goals to Thornbury. Confidentiality matters most for tenant files, which include benefit details, health needs and safeguarding notes about vulnerable residents. Integrity matters for rent accounts, because a wrong balance could lead to wrongful arrears letters. Availability matters for the repairs system, because a broken boiler in winter cannot wait. Mapping goals to real services helps him explain to colleagues why security is not an IT preference but a way of protecting tenants from concrete harms that they would recognise immediately.
1.3 Limits of a short course
Ines is honest about the course: six months will make Owen a capable practitioner who can apply methods, read evidence and work with specialists, not an expert in every area. He will learn when to ask for help, for example on cryptography, cloud configuration or legal questions. Anderson (2020) emphasises that security engineering spans many disciplines, so knowing where one's competence ends is part of professional practice. Owen writes a short list of topics he will refer to specialists, which he plans to revisit as his experience grows.
Worked example
Owen defines the three security goals in plain terms, maps each to a Thornbury service and lists topics he will refer to specialists.
Synthetic case. Thornbury, Meridian and all people are synthetic; Anderson (2020) is real.
Errors and limits
Plain-language definitions simplify. Referral lists must be revisited as skills grow.
Exercises
- EX001 — Owen's definition. How did Owen describe security in his own words?
Show marking criteria
Rubric: 3 = keep tenant information private, records correct and services running;; 2 = three parts;; 1 = vague;; 0 = none. - EX002 — Integrity example. Why does integrity matter for rent accounts?
Show marking criteria
Rubric: 3 = a wrong balance could cause wrongful arrears letters;; 2 = arrears;; 1 = vague;; 0 = none. - EX003 — Availability example. Which service shows availability's importance?
Show marking criteria
Rubric: 3 = repairs, such as a broken boiler in winter;; 2 = repairs;; 1 = portal;; 0 = none. - EX004 — Course limit. What will the course make Owen?
Show marking criteria
Rubric: 3 = a capable practitioner who knows when to ask specialists;; 2 = practitioner;; 1 = expert;; 0 = none. - EX005 — Specialist topics. Name one topic Owen will refer to specialists.
Show marking criteria
Rubric: 3 = cryptography, cloud configuration or legal questions;; 2 = one;; 1 = vague;; 0 = none.
Synthesis
Practitioners start by tying security goals to real services and knowing the limits of their competence.