◇ OpenCyber Academy
Rapid course · Chapter 1 · English

Chapter 1 — A month to get the basics right

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 1 — A month to get the basics right

Lesson map

Lesson 01 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The learner"]
  N2["1.2 The practice"]
  N3["1.3 What the clinic holds"]
  N4["1.4 What cannot be lost"]
  N5["1.5 Ground rules"]
  N6["Concepts — three goals, one harm mark"]
  N7["Data — where Hollybank's information sits"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The learner"]
  N2["1.2 The practice"]
  N3["1.3 What the clinic holds"]
  N4["1.4 What cannot be lost"]
  N5["1.5 Ground rules"]
  N6["Concepts — three goals, one harm mark"]
  N7["Data — where Hollybank's information sits"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[1.1 The learner]
    |
    v
[1.2 The practice]
    |
    v
[1.3 What the clinic holds]
    |
    v
[1.4 What cannot be lost]
    |
    v
[1.5 Ground rules]
    |
    v
[Concepts — three goals, one harm mark]
    |
    v
[Data — where Hollybank's information sits]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) describe what the one-month rapid course covers; (2) meet the running case; (3) list what a small practice holds and what it cannot lose.

1.1 The learner

Sofia Lindqvist is the practice manager at a small veterinary clinic. After a neighbouring business lost a week of work to ransomware, the owner asks her to make sure the clinic is not next. Sofia enrols on a one-month rapid course in information security at the fictional Eastgate Training Centre, with four weekly sessions and short tasks in between. Her trainer, Mr. Tomasz Nowak, has spent years helping small businesses recover from incidents. He tells the group that a month is enough to fix the most common weaknesses, though not to become an expert.

1.2 The practice

Sofia works at the fictional Hollybank Veterinary Practice, a single site with two vets, four nurses, three receptionists and a small office team, eighteen staff in all. The clinic uses a cloud practice management system for appointments, pet records and payments, a cloud email and file service, and nine computers plus two tablets. Client records hold names, addresses, phone numbers and payment history. An outside technician visits when something breaks. The owner, Dr. Rachel Moss, wants the clinic protected without slowing down the reception desk on busy mornings, when queues already build up.

1.3 What the clinic holds

In the first task, Sofia lists the information the clinic holds and where it lives. Pet and client records, appointments and payments are in the practice management system. Staff contracts and rotas are in shared folders. Supplier invoices and bank details arrive by email. Laboratory results come by email from an outside laboratory. Marketing photos for the clinic's social media pages are also in shared folders. Mr. Nowak asks her to mark each item by how much harm a leak, a wrong change or a loss would cause, using high, medium or low.

1.4 What cannot be lost

Sofia agrees three priorities with Dr. Moss. The clinic cannot lose access to the practice management system during opening hours, because appointments and treatment notes depend on it. It cannot let client contact and payment details leak, because clients trust the clinic with them and the law requires them to be protected. And it cannot pay a fraudulent supplier invoice, because margins are thin. Mr. Nowak explains that ISO/IEC 27000:2026 describes information security as protecting confidentiality, integrity and availability, and that Sofia's three priorities map neatly onto those three goals.

1.5 Ground rules

Mr. Nowak sets three rules for the month. Get Dr. Moss's written agreement before changing any setting. Never put real client details into coursework or shared examples. Write down each change with the date and the reason, so the technician and Dr. Moss can see what was done. Sofia creates a simple change log in a shared document only she and Dr. Moss can open. Mr. Nowak adds that small businesses are often harmed by well-meant changes that nobody recorded, because problems later cannot be traced back to their cause.

Worked example

Sofia joins the rapid course, lists what Hollybank's eighteen-person clinic holds, agrees three priorities tied to confidentiality, integrity and availability, and starts a change log.

Synthetic case. Eastgate, Hollybank and all people are synthetic.

Errors and limits

Unrecorded changes make later problems hard to trace.

Concepts — three goals, one harm mark

ISO/IEC 27000:2026 names confidentiality, integrity and availability. Sofia's high, medium or low mark is how Hollybank uses those goals before it buys any product. A mark is not a feeling about how secret a file sounds. It is the harm a stranger's reading, a wrong change, or a loss would cause on a real Monday.

Goal Question Already high at Hollybank Still listed when the mark is low
Confidentiality Who is harmed if a stranger reads this? Client contacts and payment history A marketing photo already on the public page
Integrity Which decision goes wrong if this is altered? Supplier bank details on an invoice A draft caption for a social post
Availability What stops during opening hours if this is gone? Practice system: appointments and treatment notes Last year's poster file

Data — where Hollybank's information sits

Information Place How it arrives Harm
Pet records, appointments, payments Cloud practice system Typed at reception High. The morning queue and the treatment notes stop together
Client name, address, phone, payment history Same system Reception High confidentiality. Clients trusted the clinic, and the law requires protection
Staff contracts and rotas Shared folders Office Contracts are sensitive. Rotas look ordinary and become a sharing problem in the next chapter
Supplier invoices and bank details Email The supplier High integrity. A wrong account number moves money
Laboratory results Email Outside laboratory High. A missing or altered result changes treatment
Marketing photos Shared folders Staff Low only after the same image is already public

Count the places, not the brand names. Six kinds of information sit in three places: the practice system, shared folders and email. The change log records a move between those places. It does not replace the mark.

Decision flow — mark one item

flowchart TD
  A["One item Sofia can name and locate"] --> B{"Would a stranger reading it harm a client or break a duty?"}
  B -->|Yes| C["Confidentiality high"]
  B -->|No| D{"Would a wrong change cause a wrong payment or a wrong treatment?"}
  D -->|Yes| E["Integrity high"]
  D -->|No| F{"Would losing it during opening hours stop appointments or notes?"}
  F -->|Yes| G["Availability high"]
  F -->|No| H["Medium or low. Keep it on the list"]
  C --> I["Write the mark, the place and the date in the change log"]
  E --> I
  G --> I
  H --> I
  I --> J["Dr. Moss agrees in writing before any setting changes"]

An item can score high on more than one goal. The flow asks the three questions in order so a busy reception does not stop at the first word that sounds technical. The log line is the evidence that the mark was made. Without the date and the reason, a later problem cannot be traced, which is the ground rule in section 1.5.

Worked example — a photograph that is not marketing

A nurse copies a wound photograph into the marketing folder so she can find it on the next shift. The filename begins with the client's first name. Sofia does not use the marketing row of the table. A stranger who opens that folder would see a clinical image tied to a client, so confidentiality is high. A missing file on the day of a recheck would also hide the comparison the vet needs, so availability is high for the working copy. Sofia moves the photograph into the practice system, deletes the shared copy, and writes the move in the change log before the end of the shift. Dr. Moss agrees in writing because staff will look in a new place tomorrow.

Synthetic case. The photograph, the filename and the nurse's shortcut are invented. No animal or client is depicted.

Apply

Exercises

Continue studying — lesson 01 (chapter 01 of 20)

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.