◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Scope, permission and safe practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Scope, permission and safe practice

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Setting scope"]
  N2["2.2 Permission"]
  N3["2.3 Handling reports safely"]
  N4["2.4 Simulations and ethics"]
  N5["2.5 Safe practice summary"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Setting scope"]
  N2["2.2 Permission"]
  N3["2.3 Handling reports safely"]
  N4["2.4 Simulations and ethics"]
  N5["2.5 Safe practice summary"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Setting scope]
    |
    v
[2.2 Permission]
    |
    v
[2.3 Handling reports safely]
    |
    v
[2.4 Simulations and ethics]
    |
    v
[2.5 Safe practice summary]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) set the scope of security work in a small charity; (2) obtain permission and respect boundaries; (3) practise safely and ethically, including on simulations.

2.1 Setting scope

Callum asks Ruth to write down what her security work will cover. In scope are reporting suspicious messages, the bank change procedure, individual accounts and a short welcome guide for volunteers. Out of scope are reading anyone's email, monitoring what volunteers do and any test that tricks people without agreement. Writing scope down helps Ruth explain her role to colleagues and protects her from being asked to do things that would damage trust, such as checking up on particular volunteers. The manager reads it.

2.2 Permission

Ruth asks the charity manager and the trustees' chair to approve her one-page scope. They sign it. She tells staff and the volunteer coordinators what she will do and why. Callum explains that permission matters even for small, friendly changes, because security work touches people's accounts, data and sense of being trusted. Asking first also brings useful ideas: the volunteer coordinator suggests including the guide in the induction pack that every new volunteer already receives, which saves Ruth from creating a separate process.

2.3 Handling reports safely

Ruth learns safe habits for handling reported messages. She never clicks links or opens attachments in reported emails; she forwards them to the charity's IT volunteer using the agreed method; and she records only the date, type and outcome, not who reported. If a report suggests something serious, such as donor data being sent to the wrong address, she follows the charity's incident steps and asks the IT volunteer for help rather than investigating alone. Safe handling protects both the charity and the person who reported.

2.4 Simulations and ethics

The charity manager asks whether Riverbend should send fake phishing emails to test volunteers. Callum explains that deception can damage trust, which a volunteer-based charity depends on. Lain, Kostiainen and Čapkun (2022) found that some common simulation practices did not help. Ruth recommends no simulations for now. If they are ever used, rules must be agreed with staff and volunteer representatives: announce the programme, avoid lures about money, food or personal hardship, give kind feedback immediately, report only totals and never use results against anyone.

2.5 Safe practice summary

Ruth writes a short safe practice summary for herself: work within the signed scope; ask before changing anyone's access; handle reports without clicking; keep records free of names; use synthetic examples in training; and practise procedures through announced role-play rather than secret tests. She pins it above her desk. Callum notes that these habits are what separate trustworthy security work from well-meant interference, and that they matter even more in charities, where people give their time freely and can simply leave if they feel mistrusted.

Worked example

Ruth writes and gets approval for a scope, adopts safe report handling, recommends no simulations with strict future rules and writes a safe practice summary.

Synthetic case. Scope and rules are synthetic; Lain et al. (2022) is real.

Errors and limits

Scope may need updating. Volunteers may not read guides.

Exercises

Synthesis

Clear scope, permission and ethical habits make security work trustworthy.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →