◇ OpenCyber Academy
Rapid course · Chapter 4 · English

Chapter 4 — Cloud and container security: guided lab and applied synthesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Cloud and container security: guided lab and applied synthesis

Lesson map

Lesson 04 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 The routine"]
  N2["4.2 Why these six"]
  N3["Lab — routine record"]
  N4["4.3 Reading the result"]
  N5["4.4 Fixing the gaps"]
  N6["4.5 Keeping it light"]
  N7["4.6 Course synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 The routine"]
  N2["4.2 Why these six"]
  N3["Lab — routine record"]
  N4["4.3 Reading the result"]
  N5["4.4 Fixing the gaps"]
  N6["4.5 Keeping it light"]
  N7["4.6 Course synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]

[Learning outcomes]
    |
    v
[4.1 The routine]
    |
    v
[4.2 Why these six]
    |
    v
[Lab — routine record]
    |
    v
[4.3 Reading the result]
    |
    v
[4.4 Fixing the gaps]
    |
    v
[4.5 Keeping it light]
    |
    v
[4.6 Course synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) set up a monthly routine; (2) measure it over three months; (3) bring the course together.

4.1 The routine

Ben helps Leila write six monthly tasks: review sharing links, check admin accounts and multi-factor authentication, check that a backup can be restored, confirm the booking app image was rebuilt, review leavers' access, and read the providers' security notices.

Each task can be done by someone who is not an IT specialist, with a clear result: a list of sharing links checked against the rule, a list of accounts with their second factor, a test folder restored, a confirmation email from the developer, a leavers list compared with active accounts, and the providers' notices read.

4.2 Why these six

Each task matches something that went wrong or nearly did: sharing, accounts, backups, the old image, leavers and changes announced by providers.

Sharing comes from the patient letters link. Accounts come from the shared reception login and the missing second factors. Backups come from old-backup.zip. The old image comes from the year without a rebuild. The leavers task protects named accounts, and the providers' notices are how the clinic learns of changes like new sharing defaults.

A task with no such origin would be the first to be skipped on a busy Monday.

Lab — routine record

"""Score a synthetic monthly cloud security routine over three months (stdlib only)."""
tasks = ["review sharing links", "check admin accounts and MFA", "check backups restored", "update booking app image",
         "review access of leavers", "read provider security notices"]
months = {"May": [1, 1, 0, 0, 1, 0], "June": [1, 1, 1, 0, 1, 1], "July": [1, 1, 1, 1, 1, 1]}
for m, done in months.items():
    miss = [t for t, d in zip(tasks, done) if not d]
    print(f"{m}: {sum(done)}/{len(tasks)} done" + (f"; missed: {', '.join(miss)}" if miss else ""))

Run with python3 lab_routine.py. Verified output:

May: 3/6 done; missed: check backups restored, update booking app image, read provider security notices
June: 5/6 done; missed: update booking app image
July: 6/6 done

4.3 Reading the result

May: 3 of 6 tasks done; missed backup restore, image update and reading notices. June: 5 of 6; the image update was still missing. July: 6 of 6.

The trend is the useful part. May's three misses each had a different cause; June fixed two of them; the image update was the slowest because it depended on someone outside the clinic. Recording the routine as numbers makes this visible: without the lab, "we mostly did it" would have hidden the fact that the image was not updated for two months in a row.

4.4 Fixing the gaps

The backup restore was missed in May because nobody knew how; Leila practises in June with a test folder. The image update was late because the developer was on holiday; they agree a backup contact.

Both fixes target the cause, not the symptom. Practising a restore on a test folder in June means the next real restore is not the first one. A backup contact at the developer means the clinic's monthly rebuild no longer depends on one person being available, which is the same idea Leila later applies to herself by training the deputy manager.

4.5 Keeping it light

The routine takes about an hour a month. Leila books it in the calendar for the first Monday.

One hour on a fixed day is what makes the routine survive a busy clinic. When Leila is on leave, the deputy manager follows the one-page instructions; August's routine was completed that way with Leila watching.

The routine is kept short on purpose: a two-day audit would be postponed whenever the clinic was busy, while one hour on a fixed Monday gets done. Leila records each month's result on the one-page log, so the trend from May to July is there for Mark to read, and the deputy can see what was missed last time before starting.

4.6 Course synthesis

In one month Leila moved from a forwarded link to a working routine: understand what the clinic controls, work within authority, keep evidence, check everything against a simple rule, keep dependencies current and repeat monthly.

Each step has a matching piece of evidence: the shared responsibility pages, Mark's written authority, the exported activity log, the sharing lab result, the developer's monthly confirmation and the routine record. A new practice manager could pick up Oakfield's security from those documents alone.

The deputy manager's August routine, done with Leila watching, tested exactly that.

4.7 Further steps

The CIS Benchmarks and CSA CCM v4 are more detailed than a small clinic needs now, but Leila keeps them as references if Oakfield grows.

If Oakfield opened a second clinic or moved the booking app to Kubernetes, Leila would start from the parts that match what already exists: the access and data-protection controls in CCM, and the benchmark for whichever storage service the clinic uses, rather than reading either document from start to finish.

Until then, the six monthly tasks cover what an eight-person clinic actually runs.

Recording

Each month's results are kept on the one-page log.

Worked example

Mark asks how he will know the routine continues if Leila is on leave. She writes the six tasks with instructions on one page and trains the deputy manager, who completes August's routine with Leila watching.

Synthetic case. Synthetic.

Errors and limits

Routines decay when one person holds them; share and record them.

Exercises

Synthesis

A light, shared monthly routine keeps a small organisation's cloud security from drifting.

Continue studying — chapter 04 of 04

← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →