Chapter 2 — Scope, permission and safe practice
Lesson map
Lesson 02 published. Map, example, EX014.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Permission first"]
N2["2.2 A small, safe scope"]
N3["2.3 Personal data and secrets"]
N4["2.4 Reporting responsibly"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX014"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Permission first"]
N2["2.2 A small, safe scope"]
N3["2.3 Personal data and secrets"]
N4["2.4 Reporting responsibly"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX014"]
[Learning outcomes]
|
v
[2.1 Permission first]
|
v
[2.2 A small, safe scope]
|
v
[2.3 Personal data and secrets]
|
v
[2.4 Reporting responsibly]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX014]
Learning outcomes
You will (1) explain why permission comes before any check; (2) define a small, safe scope; (3) handle personal data and secrets with care; (4) report problems responsibly.
2.1 Permission first
Leo is curious and wants to scan the library's network to see what is there. Inês stops him: checking systems without permission can be illegal, can break fragile devices like the old self-service kiosk and can upset partners whose systems sit on the same network. Even with good intentions, testing needs written permission from the person responsible. For Leo, that is the library manager, who signs a short note. Leo learns that asking first is not a formality; it protects the library, its members and Leo himself, and it builds the trust that lets him help again later.
2.2 A small, safe scope
The signed note lists exactly what Leo may do: read the library website's certificate details in his browser, check that staff laptops have disk encryption turned on, and review whether the e-book account page uses a strong password policy. It lists what he may not do: scan the network, try passwords, touch the book supplier's systems or the council's Wi-Fi equipment. It also names the week and Inês as his contact. A small scope keeps a beginner's first task safe and finishable. Leo writes the scope at the top of his notes and checks each step against it before starting.
2.3 Personal data and secrets
Libraries hold personal data: names, addresses, borrowing history. While checking a laptop, Leo might see member records on screen. Inês teaches him to look only at what the task needs, close anything else and never copy personal data into his notes. If he finds a password written on a sticky note or saved in a text file, he records where it was and what kind of secret it is, but not the password itself, and tells Inês the same day so it can be changed. Writing a secret down in a report would only spread the problem further.
2.4 Reporting responsibly
When Leo finds something wrong, he reports it to Inês and the manager, not to friends or social media. His report says what he saw, where, when and why it matters, in plain words, with a suggested next step. If he ever spotted a weakness in a product many libraries use, such as the e-book platform, the right path would be to tell the supplier privately through the library so they can fix it before details become public. This is called coordinated disclosure. Responsible reporting turns a discovery into a fix instead of a new risk.
Worked example
Leo gets a signed scope note, checks two laptops for disk encryption within it, finds a password sticky note, records only its location and reports it to Inês.
Synthetic case. The scope note, laptops and sticky note are synthetic.
Errors and limits
Permission does not make careless work safe. Rules on personal data vary by country; follow the library's policy.
Exercises
- EX014 — Scan refusal. Why did Inês stop Leo scanning the network? Rubric: 3 = no permission; could be illegal, break devices or affect partners;; 2 = one reason;; 1 = fine to scan;; 0 = none.
- EX015 — Who grants permission. Who signs Leo's permission note? Rubric: 3 = the library manager;; 2 = manager;; 1 = Leo;; 0 = none.
- EX016 — Allowed checks. List two checks Leo may do. Rubric: 3 = two of read website certificate, check laptop disk encryption, review password policy;; 2 = one;; 1 = scan network;; 0 = none.
- EX017 — Forbidden actions. Name two actions outside Leo's scope. Rubric: 3 = two of scanning, trying passwords, supplier systems, council Wi-Fi equipment;; 2 = one;; 1 = vague;; 0 = none.
- EX018 — Small scope benefit. What does a small scope give a beginner? Rubric: 3 = a safe, finishable first task;; 2 = safe;; 1 = vague;; 0 = none.
- EX019 — Member record seen. What should Leo do if a member's record appears on screen? Rubric: 3 = look only at what the task needs, close it and not copy it;; 2 = close it;; 1 = copy it;; 0 = none.
- EX020 — Sticky note. How should Leo record a password found on a sticky note? Rubric: 3 = location and type only, then tell Inês to change it;; 2 = location;; 1 = writes password;; 0 = none.
- EX021 — Report contents. What should Leo's report include? Rubric: 3 = what, where, when, why it matters and a next step;; 2 = three;; 1 = vague;; 0 = none.
- EX022 — Wrong audience. Who should not hear about a weakness first? Rubric: 3 = friends or social media;; 2 = names;; 1 = the manager;; 0 = none.
- EX023 — Platform weakness. How should a weakness in the e-book platform be handled? Rubric: 3 = coordinated disclosure to the supplier through the library;; 2 = supplier;; 1 = post online;; 0 = none.
- EX024 — Coordinated disclosure name. What is the private-first reporting path called? Rubric: 3 = coordinated disclosure;; 2 = named;; 1 = vague;; 0 = none.
- EX025 — Kiosk risk. Which fragile device could an unapproved scan disrupt? Rubric: 3 = the old self-service kiosk;; 2 = kiosk;; 1 = vague;; 0 = none.
- EX026 — Protection of asking. Whom does asking permission protect? Rubric: 3 = the library, its members and Leo;; 2 = two;; 1 = nobody;; 0 = none.
Synthesis
Safe practice means getting permission, keeping a small scope, handling personal data and secrets carefully and reporting through the right people.
Continue studying — chapter 02 of 04
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →