OpenCyber Academy
Rapid course · Chapter 2 · English
Course code: OCA-013Chapter 02: OCA-013-C002

Chapter 2 — Scope, permission and safe practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Authority"]
  N2["2.2 Evidence first"]
  N3["2.3 What the log shows"]
  N4["2.4 Data protection"]
  N5["2.5 Safe practice"]
  N6["2.6 Accounts"]
  N7["2.7 Multi-factor authentication"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Authority"]
  N2["2.2 Evidence first"]
  N3["2.3 What the log shows"]
  N4["2.4 Data protection"]
  N5["2.5 Safe practice"]
  N6["2.6 Accounts"]
  N7["2.7 Multi-factor authentication"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Authority]
    |
    v
[2.2 Evidence first]
    |
    v
[2.3 What the log shows]
    |
    v
[2.4 Data protection]
    |
    v
[2.5 Safe practice]
    |
    v
[2.6 Accounts]
    |
    v
[2.7 Multi-factor authentication]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) work within the clinic's authority and data protection duties; (2) collect evidence safely; (3) avoid risky shortcuts.

2.1 Authority

As practice manager, Leila is authorised by the clinic's owner, physiotherapist Mark Ellis, to manage accounts and settings. She confirms this in writing for the course and agrees she will only review Oakfield's own services.

Getting this in writing is not a formality. Leila will change sharing settings, remove the shared reception login and delete an old backup; each could upset a colleague or touch patient data. Mark's written authority shows she acted for the clinic. Limiting herself to Oakfield's own services means she does not probe the hospital's system, the developer's other clients or the providers' infrastructure.

2.2 Evidence first

Before changing more settings, Leila exports the storage service's sharing report and the activity log for the patient letters folder. She saves them with date and time in a restricted folder.

Order matters because the storage service may show only the current settings. Once a folder is changed to staff-only, the sharing report shows staff-only, and the record of who opened the letters while the link was open survives only in the activity log. When a colleague later suggests deleting the log to tidy up, Leila keeps it: it is the clinic's proof of what happened.

2.3 What the log shows

The activity log shows the folder was set to anyone-with-link in January when a colleague shared one letter with a hospital. The log records four views from outside the clinic: three match the hospital's domain, one is the patient's own forwarded view.

Those four views are what turn worry into an answer. Three came from the hospital the letter was meant for; the fourth was the patient opening the link she had been forwarded. No view came from an unknown address. That is why Leila can record the risk as low, while still recording that the folder was open from January to April.

2.4 Data protection

Leila follows the regulator's guidance for small organisations, recording what happened, who was affected and why she judges the risk low. Mark, as data controller, makes the final decision and records it.

Her record states the facts from the log: the folder was open by link from January to April, four outside views were recorded, three matched the hospital's domain and the fourth was the patient's own. It also states her reasoning about risk. Mark makes the decision because the clinic, not its practice manager, is legally responsible for patient data, and his decision is recorded alongside hers.

2.5 Safe practice

Leila does not try to "test" whether other links work by guessing addresses or using outside tools. She uses the provider's own reports and settings pages.

Guessing link addresses might reach someone else's files, and outside scanning tools might break the provider's terms. The provider's sharing report already lists every item shared by link, which is what the course lab checks against the clinic's rule. Using it gives Leila a complete answer without touching anything she is not authorised to test.

2.6 Accounts

Each staff member has their own account; the shared reception login is replaced, so the logs show who did what.

The shared reception login was the gap here. If the patient letters folder had been changed by someone signed in as reception, the activity log could not say which of the eight staff did it. With named accounts, the log shows who shared what, and a leaver's access can be removed without changing everyone else's password. The monthly routine's leavers check depends on this.

2.7 Multi-factor authentication

All accounts get a second factor. Two staff without smartphones receive hardware keys.

Multi-factor authentication matters most for the accounts that can change sharing settings: a stolen password alone could otherwise reopen the patient letters folder to the world. The two hardware keys solve a practical problem rather than forcing the two staff members to buy smartphones. Leila records which staff have which factor, so the monthly admin check can confirm that nobody has slipped back to password only. Each key is labelled with its owner's name, and a spare is kept locked in the office.

Leavers

When staff leave, Leila removes their accounts on their last day and checks whether they owned any shared links, which are moved to a current staff member.

Worked example

A colleague suggests deleting the activity log to "tidy up". Leila explains that the log is evidence and must be kept, and that tidying would remove the clinic's proof of what happened.

Synthetic case. Synthetic.

Errors and limits

Changing settings before exporting evidence can erase the record of what was exposed.

Exercises

Synthesis

Work within authority, keep evidence, and avoid risky shortcuts.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →

Worked answers

EX014. Mark Ellis, the clinic owner.

EX015. The sharing report and the folder's activity log.

EX016. A colleague shared a letter with a hospital in January.

EX017. Four views: three from the hospital, one the patient's forwarded view.

EX018. Mark, as data controller.

EX019. Guessing addresses or using outside tools to test links.

EX020. So logs show which person did what.

EX021. They received hardware keys.

EX022. It is the evidence of what happened.

EX023. Changes can erase the record of exposure.

EX024. Only Oakfield's own services.

EX025. What happened, who was affected and why she judges the risk low.

EX026. It makes limits clear and protects everyone.