◇ OpenCyber Academy
Rapid course · Chapter 4 · English

Chapter 4 — Cybersecurity: guided lab and applied synthesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Cybersecurity: guided lab and applied synthesis

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  A["Synthetic action"] --> B{"Named in the written rule?"}
  B -->|No| U["UNKNOWN"]
  B -->|Yes| C{"Which action?"}
  C -->|open-live-site| S["STOP"]
  C -->|export-contacts| O["OUT OF SCOPE"]
  C -->|confirm-from-printout| D{"Created after 09:00?"}
  D -->|Yes| R["REFUSE"]
  D -->|No| L["ALLOW"]
  C -->|mark-pending| L

The diagram classifies one invented action. It does not describe a real library, and ALLOW is not proof that a room is free.

Logical drawing

written rule + synthetic row
        |
        +-- open live site --------> STOP
        +-- export contacts -------> OUT OF SCOPE
        +-- confirm from 09:00 paper
        |         |
        |         +-- later booking exists --> REFUSE
        |         +-- no later booking -----> ALLOW
        +-- mark pending ----------> ALLOW
        +-- anything else ---------> UNKNOWN

Learning outcomes

After this chapter, you should be able to:

  1. Apply a written rule to a synthetic staff action and name the verdict the rule produces.
  2. Separate a classification of a recorded proposal from a decision that the real service is safe.
  3. Explain why ALLOW, REFUSE, OUT OF SCOPE and STOP answer different questions.
  4. State one fact the offline script cannot know.
  5. Write a short dossier that keeps the observation, the decision and the limit in separate sentences.

4.1 Four verdicts, one written rule

Chapters 1–3 left a front-desk worker with a 09:00 paper schedule, two invented bookings, and a rule: do not confirm a later room from that paper, do not open a live site, and do not pull the event-contact list into the booking exercise. Chapter 4 turns that rule into a check a second person can rerun.

The check uses four verdicts. They are labels for this exercise, not a severity scale.

Verdict Question it answers What it does not answer
STOP Did this action leave the paper exercise? Whether a real site is under attack
OUT OF SCOPE Is this data set outside the booking decision? Whether the contact list is well protected
REFUSE Does the 09:00 snapshot omit a later booking for that room and start? Why the booking page was unavailable
ALLOW Does the written rule permit this recorded action? Whether Room 2 is actually free
UNKNOWN Is the action missing from the rule set? What the owner would decide after being asked

A number such as 7.4 would hide which of these questions changed. This chapter does not score the library.

4.2 The script reads the exercise assumption

The lab below is standard-library Python. It encodes three assumptions already fixed in this book: the printout time is 09:00, SYN-002 was created at 10:05 for Room 2 at 15:00, and event contacts are outside the booking path. It does not read the Chapter 3 owner report of an 11:40 offline sheet. That report is still unverified, so the script must not treat it as a newer printout.

REFUSE fires only when a confirm-from-printout action names a room and start whose booking was created after 09:00. ALLOW on mark-pending means the rule accepts a pending queue. ALLOW on a confirmation means only that no later booking in this tiny table matches that room and start. A different room can therefore print ALLOW while remaining unknown in the real building.

4.3 Worked example: four actions

Use the same rows the script uses.

Time Action Why the rule speaks Verdict
11:42 Confirm Room 2 at 15:00 from the paper SYN-002 was created at 10:05, after the printout REFUSE
11:43 Export event contacts Announcement contacts are not the booking decision OUT OF SCOPE
11:44 Open the live booking site The brief forbids production systems STOP
11:45 Mark the 15:00 request pending The fallback rule allows a pending queue ALLOW

The 11:44 line classifies a recorded proposal. It does not by itself halt a classroom. In a live rehearsal the owner still pauses the people, as Chapter 2 required. The script keeps going so the other three rows stay visible. That difference is a limit of the program, not a softer stop condition.

4.4 Lab: classify the synthetic log

Save this program as lab_dossier.py and run it with python3 lab_dossier.py. Do not point it at a network, a library website, or a file of real patrons. The expected output is fixed for these rows. If your output differs, the rule you ran is not the rule in this chapter.

"""Harbor Library tabletop dossier. Synthetic records only."""

PRINTOUT = "09:00"

BOOKINGS = [
    {"id": "SYN-001", "room": "Room 2", "start": "14:00", "created": "08:20", "status": "confirmed"},
    {"id": "SYN-002", "room": "Room 2", "start": "15:00", "created": "10:05", "status": "confirmed"},
]

ACTIONS = [
    {"time": "11:42", "action": "confirm-from-printout", "room": "Room 2", "start": "15:00"},
    {"time": "11:43", "action": "export-contacts"},
    {"time": "11:44", "action": "open-live-site"},
    {"time": "11:45", "action": "mark-pending", "room": "Room 2", "start": "15:00"},
]


def minutes(clock):
    hour, minute = clock.split(":")
    return int(hour) * 60 + int(minute)


def decide(action):
    kind = action["action"]
    if kind == "open-live-site":
        return "STOP", "live site is outside the paper exercise"
    if kind == "export-contacts":
        return "OUT OF SCOPE", "event contacts are outside the booking decision"
    if kind == "confirm-from-printout":
        later = [
            booking["id"]
            for booking in BOOKINGS
            if booking["room"] == action["room"]
            and booking["start"] == action["start"]
            and minutes(booking["created"]) > minutes(PRINTOUT)
        ]
        if later:
            return "REFUSE", "printout 09:00 omits " + ",".join(later)
        return "ALLOW", "no later booking is recorded for that room and start"
    if kind == "mark-pending":
        return "ALLOW", "pending until an approved current source"
    return "UNKNOWN", "the written rule set does not name this action"


def main():
    print("printout: 09:00; bookings: 2")
    omitted = [booking["id"] for booking in BOOKINGS if minutes(booking["created"]) > minutes(PRINTOUT)]
    print("omitted by printout: " + ",".join(omitted))
    counts = {"STOP": 0, "OUT OF SCOPE": 0, "REFUSE": 0, "ALLOW": 0, "UNKNOWN": 0}
    for action in ACTIONS:
        verdict, reason = decide(action)
        counts[verdict] += 1
        print(f"{action['time']} {action['action']}: {verdict}; {reason}")
    print(
        "STOP {STOP}; OUT OF SCOPE {OUT OF SCOPE}; REFUSE {REFUSE}; ALLOW {ALLOW}; UNKNOWN {UNKNOWN}".format(
            **counts
        )
    )


if __name__ == "__main__":
    main()

Exact output, checked with Python 3:

printout: 09:00; bookings: 2
omitted by printout: SYN-002
11:42 confirm-from-printout: REFUSE; printout 09:00 omits SYN-002
11:43 export-contacts: OUT OF SCOPE; event contacts are outside the booking decision
11:44 open-live-site: STOP; live site is outside the paper exercise
11:45 mark-pending: ALLOW; pending until an approved current source
STOP 1; OUT OF SCOPE 1; REFUSE 1; ALLOW 1; UNKNOWN 0

The count line is a tally of these four rows. It is not a risk rating. Changing the 11:42 room to Room 4, which does not appear in BOOKINGS, makes that row ALLOW. The new ALLOW means the table has no later booking for Room 4 at 15:00. It does not mean a resident may have the room.

4.5 A dossier uses only what the run showed

Write six short sentences and stop. Sentence 1 names the exercise and the 09:00 assumption. Sentence 2 quotes one output line. Sentence 3 states the decision that line supports. Sentence 4 names a verdict that must not be merged with it: exporting contacts is OUT OF SCOPE, not REFUSE, because the contact list was never a booking-time comparison. Sentence 5 says the script did not inspect a reservation store and did not accept the unverified 11:40 report. Sentence 6 names the owner question that is still open: which approved source, if any, may replace the 09:00 paper.

If sentence 5 is blank, the note is not ready to guide a procedure change. A blank limit lets a reader treat a classroom tally as a finding about Harbor Library's real systems, which this book does not have.

Chapter 4 summary

A written rule can classify a synthetic action the same way twice. STOP, OUT OF SCOPE, REFUSE, ALLOW and UNKNOWN answer different questions. The program's ALLOW is permission under the rows it was given, not evidence that a room is free or that a reported 11:40 sheet exists. The dossier keeps the output, the decision and the limit apart.

Chapter 4 exercises

Use the program and output in Section 4.4. Do not contact a real library. Worked results are in the appendix.

EX016 — Read the tally

EX017 — ALLOW is not availability

EX018 — Do not merge the verdicts

EX019 — Script stop versus human stop

EX020 — Six-sentence dossier

Continue studying — chapter 04 of 20

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.

Worked answers

EX016 — Worked result

The REFUSE line is 11:42 confirm-from-printout. The reason names SYN-002. That id is absent from the paper because the exercise printout is fixed at 09:00 and the booking was created at 10:05. The output does not say an attacker caused the gap.

EX017 — Worked result

Room 4 at 15:00 has no row created after 09:00, so the rule prints ALLOW and the reason says no later booking is recorded for that room and start. The staff member must not tell a resident that Room 4 is free. ALLOW here means the synthetic table did not contain a conflicting later booking.

EX018 — Worked result

REFUSE compares a printout time with a booking created later. The 11:43 export never makes that comparison, so the rule returns OUT OF SCOPE. This run does not show who can download the contact list, how long it is kept, or whether a control on it works.

EX019 — Worked result

After STOP, the program still prints the 11:45 mark-pending line and the final tally. A facilitator pauses the participants, does not let anyone open a site, and asks the exercise owner what happens next. The program is replaying a log; the facilitator is responsible for the people in the room.

EX020 — Worked result

One acceptable note: The exercise classified four synthetic actions against a 09:00 printout. At 11:42 the program refused confirmation of Room 2 at 15:00 because the paper omits SYN-002. The decision is to leave that request pending rather than confirm it from the paper. The 11:43 export is out of scope, not a refused booking. The script did not open a reservation store and did not treat the reported 11:40 sheet as verified. The open question for the owner is which approved source, if any, may replace the 09:00 paper. No numeric score belongs in the note.