◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Scope, permission and safe practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Scope, permission and safe practice

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Why permission matters"]
  N2["2.2 Writing a simple scope"]
  N3["2.3 Third-party equipment"]
  N4["2.4 Working safely on a live business"]
  N5["2.5 Handling information"]
  N6["2.6 Stopping and asking"]
  N7["2.7 Recording what was done"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Why permission matters"]
  N2["2.2 Writing a simple scope"]
  N3["2.3 Third-party equipment"]
  N4["2.4 Working safely on a live business"]
  N5["2.5 Handling information"]
  N6["2.6 Stopping and asking"]
  N7["2.7 Recording what was done"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Why permission matters]
    |
    v
[2.2 Writing a simple scope]
    |
    v
[2.3 Third-party equipment]
    |
    v
[2.4 Working safely on a live business]
    |
    v
[2.5 Handling information]
    |
    v
[2.6 Stopping and asking]
    |
    v
[2.7 Recording what was done]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) agree written scope and permission; (2) work safely on a live business; (3) handle information responsibly.

2.1 Why permission matters

Even helpful security work needs permission. Changing router settings, looking at device lists or reading logs can disrupt a business or reveal private information. Without the owner's permission, such actions may also break the law. Nadia makes this the first practical lesson: before touching anything at the bakery, Leo agrees in writing with Ellen what he will do, when and how. Permission is not a formality; it protects Ellen's business, her customers and Leo himself, and it is expected of anyone doing security work.

2.2 Writing a simple scope

Leo's scope is one page. It lists what he may do: view the router's settings with Ellen present, export the list of connected devices, check settings against a checklist and, with Ellen's approval of each change, adjust Wi-Fi and router settings. It lists what he may not do: access the card reader's internal settings, which belong to the payment provider; open business files on the office computer; or make changes during opening hours. Both sign it. A short, clear scope prevents misunderstandings and makes it easy to check whether a task is allowed.

2.3 Third-party equipment

Some equipment at the bakery belongs to others. The card reader is provided and managed by a payment company under its own security rules; changing its settings could break payments and the contract. The router belongs to the internet provider, though Ellen can change its settings. Leo checks each device's owner and any contract terms before suggesting changes. Where a change affects a third party's equipment, he recommends Ellen contact the provider rather than doing it himself. Respecting ownership avoids accidental breaches of contracts and service.

2.4 Working safely on a live business

The bakery cannot afford downtime during opening hours. Leo plans every change for after closing, keeps a note of the original settings so he can put them back, and tests that tills and card payments work afterwards. He changes one thing at a time so that if something breaks, the cause is obvious. He also keeps Ellen's phone number handy and stops if anything unexpected happens. These habits are simple, but they are what separate safe practice from well-meant disruption.

2.5 Handling information

During the work, Leo sees information such as device names, customer Wi-Fi usage and possibly the Wi-Fi password. He writes down only what he needs, stores notes on the skills centre's secure storage rather than his personal phone, and never shares passwords by message. If he changes the Wi-Fi password, he gives it to Ellen in person or on paper. When the course ends, he deletes his notes as agreed. Careful handling of information is part of trustworthiness, and small businesses rely heavily on trust.

2.6 Stopping and asking

Sometimes a task reveals something outside scope, such as an unknown device or an odd message in the router's log. Leo's rule is to stop, write down what he saw and ask Ellen before going further. He does not investigate the unknown device's contents or try to connect to it. In week three, this rule matters when he finds two unknown devices. Stopping and asking may feel slow, but it keeps the work within agreed limits and lets the owner decide what happens next.

2.7 Recording what was done

Every action is recorded: date, time, what was changed, original value, new value and who approved it. Leo uses a simple table in a notebook and copies it into his final report. The record helps if something goes wrong later, because anyone can see exactly what changed and when. It also shows Ellen the value of the work and gives her a reference for the future. Recording actions is a habit worth starting from the very first task, even in a small shop.

Worked example

Leo and Ellen sign a one-page scope listing four permitted activities, three exclusions and a rule to make changes only after closing.

Synthetic case. The scope is synthetic.

Errors and limits

Changing a payment provider's device without permission can break payments and contracts.

Exercises

Synthesis

Written scope, respect for ownership, safe timing and careful records make security help trustworthy.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →