OpenCyber AcademyLesson map
Lesson 16. Map, example, EX062.
flowchart TD
A["Loan payment crosses into core banking"] --> B["Written scope excludes core banking"]
B --> C{"Does the crossing include it?"}
C -->|No| D["Label the crossing and keep the exclusion"]
C -->|Yes| E["That would widen the approval"]
A flow can name a system the approval leaves out.
Logical drawing
in scope
loan system
staff PCs that use it
document upload
out of scope
core banking at the service bureau
card processor
allowed
read settings, interview staff
not allowed
attacks, member files, investigating alone
Learning outcomes
After this chapter, you should be able to:
- Keep core banking and the card processor outside the written scope.
- Label the loan payment as a crossing, not as inclusion.
- Leave the approval's dates uninvented.
16.1 The arrow crosses a boundary the approval does not move.
A loan approval triggers a payment through core banking. That flow is drawn and marked where it reaches a supplier. The written scope still excludes core banking, run by the service bureau, and the card processor. Leah may read loan settings and interview staff. She may not attempt attacks, open member files, or investigate a stop condition alone. A classmate says the payment arrow puts core banking inside the review, and fills dates on the approval that the book never states. Leah keeps the exclusion. She does not widen the written approval.
16.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Argument | Scope page | Decision |
|---|---|---|
| "The payment crosses into core banking." | A labeled flow | May stay |
| "Core banking is excluded." | The written scope | May stay |
| "The arrow includes it." | The exclusion still stands | Refuse |
| "Write the approval dates." | Dates are not in the book | Refuse |
Synthetic case. No attack is run. No member file is opened.
Errors and limits
An exclusion does not make the excluded system safe. It says this review was not the place to test it.
Apply
- EX062 — Does the payment include core banking? The loan flow pays through core banking. The written scope excludes core banking and the card processor. A classmate widens the approval and writes dates. What stays excluded, and what do you not invent?
Show marking criteria
Rubric: 3 = the crossing stays a crossing; core banking and the card processor stay excluded; do not invent approval dates; do not attack or open member files;; 2 = the exclusion stands;; 1 = one of those;; 0 = none.