◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Scope, permission and safe practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Scope, permission and safe practice

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Scope"]
  N2["2.2 Permission"]
  N3["2.3 Safe-practice rules"]
  N4["2.4 Protecting other people"]
  N5["2.5 Asking for help"]
  N6["2.6 Recording"]
  N7["2.7 Changing scope"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Scope"]
  N2["2.2 Permission"]
  N3["2.3 Safe-practice rules"]
  N4["2.4 Protecting other people"]
  N5["2.5 Asking for help"]
  N6["2.6 Recording"]
  N7["2.7 Changing scope"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Scope]
    |
    v
[2.2 Permission]
    |
    v
[2.3 Safe-practice rules]
    |
    v
[2.4 Protecting other people]
    |
    v
[2.5 Asking for help]
    |
    v
[2.6 Recording]
    |
    v
[2.7 Changing scope]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) set a written scope; (2) explain why permission matters; (3) follow safe-practice rules with suspicious files; (4) protect other people's data.

2.1 Scope

Scope says what you may look at, for which purpose and for how long. Priya writes: "Laptop FB-LAP-02 only; purpose: find what the downloaded file installed and whether food bank data is at risk; Tuesday–Friday." Tomás's personal phone is not in scope.

Each part of Priya's scope has a reason. One laptop, because that is where the problem appeared. A question, so she knows when she has finished. Four days, so the work does not drift into a general review of every food bank computer. Tomás's phone is excluded because it belongs to him, not the food bank.

2.2 Permission

Looking at a computer without the owner's permission can break the law and trust. Ana, the coordinator, signs the scope. Tomás agrees too, since he used the laptop and may have personal browser data on it.

Ana's signature also protects Priya. If someone later asks why she looked at the laptop, she can show the signed scope. Tomás's agreement matters because his personal browser data may be on the laptop; Priya tells him she will not read his personal browsing beyond what the question needs, such as the advert page visited just before the download.

2.3 Safe-practice rules

Never run a suspicious file to "see what it does". Never send it by ordinary email. Never upload it to public websites without permission, because files can contain private data. Work on a copy of evidence when possible. Keep the laptop off the network.

Priya follows each rule in this case. She never runs FreeTemplates_setup.exe; she calculates its hash instead. She does not upload the file to a public checking website, because Ana has not agreed and the file might contain private data. She keeps FB-LAP-02 off Wi-Fi until it is restored. When she copies her notes to a USB stick, she copies only her own notes and results, not the suspicious file.

2.4 Protecting other people

The laptop holds a list of food bank clients. Priya looks only at what the question needs and does not open the client list. If client data was at risk, Ana must decide whether to tell people.

The question is whether the downloaded file could have read or sent data, not what the client list says. If the evidence had shown data leaving the laptop, Priya would have told Ana what kind of data was on it, and Ana, not Priya, would decide whether clients must be told. In this case nothing pointed to data leaving, and the client list stayed unopened.

2.5 Asking for help

When something is beyond her skill, Priya asks a trusted professional rather than guessing. Knowing your limits is part of safe practice.

In this case, the evidence pointed to a known adware installer with no sign of email misuse, which Priya could handle. If the hash had matched nothing and the laptop had shown signs of sending data out, she would have stopped and asked Ana to bring in a professional incident responder, keeping the laptop disconnected and her notes ready to hand over.

2.6 Recording

Scope, permission, and any change to them are written and dated.

Priya's scope page shows three dated entries: the original scope signed by Ana on Tuesday, Tomás's agreement, and Wednesday's change that added "food bank email account sign-in history". Each entry says who agreed and when. If anyone later asks why Priya looked at the email account, the page answers the question without anyone having to remember. A spoken "yes, go ahead" in a corridor is easy to forget or dispute; a dated line is not.

2.7 Changing scope

If Priya finds signs that another laptop is affected, she asks Ana before looking at it.

The email account is the case's real example. On Wednesday, Priya saw that Tomás had saved the food bank email password in the browser. Checking whether the account was misused was outside the original scope, which covered the laptop only. She asked Ana, who added the email sign-in history to the scope in writing. Only then did Priya look. If another laptop had shown the same pop-ups, the same step would apply before she touched it.

Worked example

The scope change Priya added on Wednesday reads: "Added: food bank email account sign-in history. Reason: Tomás's food bank email password is saved in the browser on FB-LAP-02, so the account may have been misused. Agreed by: Ana, coordinator." The line sits under the original Tuesday scope, which stays unchanged.

Synthetic case. The scope and events are invented.

Errors and limits

Good intentions do not replace permission; ask first even when it feels slow.

Exercises

Synthesis

Write the scope, get permission, handle suspicious files safely, protect others' data and widen scope only in writing.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →