◇ OpenCyber Academy
Rapid course · Chapter 2 · English

Chapter 2 — Scope, permission and safe practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Scope, permission and safe practice

Lesson map

Lesson 02 published. Map, example, EX014.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Why permission matters"]
  N2["2.2 A simple scope"]
  N3["2.3 Collecting only what you need"]
  N4["2.4 Responsible handling"]
  N5["2.5 Unsafe experiments"]
  N6["2.6 Reporting clearly"]
  N7["2.8 Practice activities"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX014"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Why permission matters"]
  N2["2.2 A simple scope"]
  N3["2.3 Collecting only what you need"]
  N4["2.4 Responsible handling"]
  N5["2.5 Unsafe experiments"]
  N6["2.6 Reporting clearly"]
  N7["2.8 Practice activities"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX014"]

[Learning outcomes]
    |
    v
[2.1 Why permission matters]
    |
    v
[2.2 A simple scope]
    |
    v
[2.3 Collecting only what you need]
    |
    v
[2.4 Responsible handling]
    |
    v
[2.5 Unsafe experiments]
    |
    v
[2.6 Reporting clearly]
    |
    v
[2.8 Practice activities]
    |
    v
[Worked example] --> [Exercise EX014]

Learning outcomes

You will (1) explain why permission is essential before checking any system; (2) write a simple scope; (3) collect only the information you need; (4) handle what you find responsibly; (5) avoid unsafe "experiments"; and (6) report clearly.

2.1 Why permission matters

Looking at how a website or service protects its connections can feel harmless, and ordinary use — visiting a site in your browser — is fine. But deliberately probing systems, running scanning tools or trying to make a connection use weaker settings is different: without the owner's permission it may be illegal, it can disrupt the service, and it breaks trust. Professionals always have written permission that says what they may do. In this course you will only work with your own devices, the bakery's systems with Priya's written agreement, and lab examples on your own computer.

2.2 A simple scope

A scope answers five questions: What systems may I look at? How may I look (for example, read settings, read documents, use my browser normally)? When? What will I do with the information? Who do I call if something seems wrong? Example: "With Priya's agreement on 1 October, I may review the bakery's account settings pages, provider documentation and my own browser's connection details for the online shop between 1 and 31 October. I will keep notes in a shared folder only Priya and I can access. I will not run scanning tools or test anything on the payment system. If anything looks wrong, I will tell Priya and the provider's support team."

2.3 Collecting only what you need

To understand quantum readiness, you need facts such as which provider runs a service, which security settings or versions it uses, and how long data must be kept. You do not need customers' names, card numbers, passwords or message contents. Writing down less is safer: if your notes are lost, nothing sensitive leaks.

At the bakery, a useful note might read: online shop, run by the web-shop provider, customer accounts kept about ten years. It would not include any customer's name or address. If you need an example to explain something, make one up rather than copying real data.

2.4 Responsible handling

If you come across something sensitive or worrying — a password written on a sticky note, a shared folder open to everyone, an alert from a provider — do not explore further. Tell the owner (Priya) straight away and suggest contacting the provider. Never try to "test" whether a found password works. If you think you have found a weakness in a company's product, tell the company privately; do not post about it publicly.

Write down what you saw, where and when, without copying the sensitive item itself. A note such as sticky note with a password on the office monitor, 9 October, reported to Priya is enough. The owner and the provider decide what happens next; your job is to tell them quickly and to stop there.

2.5 Unsafe experiments

Some online guides show how to force a connection to use older, weaker settings ("downgrade") or how to capture other people's network traffic. These are only appropriate in isolated labs run by trained professionals with permission. In this course, labs run entirely on your own computer with made-up data.

If you see such a guide, you can still learn from reading it, but do not follow its steps on any network you use, including the bakery's Wi-Fi. If a classmate or friend suggests trying one, explain that it could break other people's connections and that permission from the network owner is needed first.

2.6 Reporting clearly

A good note says: what you looked at, when, how, what you found, why it matters and what you suggest. Example: "8 October, bakery account page of the email provider (read only): the provider's help page says connections use modern TLS and lists post-quantum key exchange as 'rolling out'. Matters because staff emails include payroll attachments. Suggest: ask the provider for a date."

Short notes are easier to act on than long ones. Write each note on the day you make the observation, and keep the date and source with it. If you later learn something that changes the note, add a dated correction rather than editing the original, so that Priya can see what was known when.

2.7 Worked example

A classmate says: "Let's scan the shopping centre's Wi-Fi to see whose devices are quantum-vulnerable." The safe answer: "We don't have permission and it could expose other people's data. Instead, let's look at our own phones' settings and read the Wi-Fi provider's public documentation."

The answer refuses politely and offers a safe alternative that still teaches something. It also explains why: other people's data and the lack of permission. If the classmate insists, the right move is to stop and talk to a teacher or the venue's owner rather than argue.

2.8 Practice activities

  1. Write a scope for reviewing your own home router's settings. 2. List three pieces of information you would not write down during a review. 3. Rewrite a vague note ("email is fine I think") into a clear one.

For the first activity, use the five scope questions from earlier in this chapter. For the second, think of things that would cause harm if your notes were lost. For the third, add what, when, how and the source to the vague note, and remove the words I think.

2.9 Common mistakes

Each mistake has a simple correction. Public means anyone may visit, not that anyone may test. Notes should hold facts about settings and providers, never secrets. Finding something sensitive is the signal to stop and tell the owner. And weaknesses are reported privately so the owner can fix them first.

Exercises

Synthesis

Safe practice starts with permission and a clear scope, collects only what is needed, handles sensitive discoveries responsibly, avoids risky experiments and reports clearly.

Continue studying — chapter 02 of 04

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →