Chapter 2 — Scope, permission and safe practice
Lesson map
Lesson 02 published. Map, example, EX014.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Setting scope"]
N2["2.2 Written permission"]
N3["2.3 Safe handling of member data"]
N4["2.4 Stop conditions"]
N5["2.5 A finding under scope"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX014"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Setting scope"]
N2["2.2 Written permission"]
N3["2.3 Safe handling of member data"]
N4["2.4 Stop conditions"]
N5["2.5 A finding under scope"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX014"]
[Learning outcomes]
|
v
[2.1 Setting scope]
|
v
[2.2 Written permission]
|
v
[2.3 Safe handling of member data]
|
v
[2.4 Stop conditions]
|
v
[2.5 A finding under scope]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX014]
Learning outcomes
You will (1) set the scope of a small security review; (2) obtain written permission; (3) work safely with member data.
2.1 Setting scope
Leah's manager asks her to review security around Saltmarsh's new loan application system. Felix teaches her to write a scope first: which systems are included, which are excluded, what she will do and what she will not do. Included are the loan system, the staff PCs that use it and the document upload feature for members. Excluded are the core banking system, run by a service bureau, and the card processor. She will read settings and interview staff; she will not attempt attacks or access member files.
2.2 Written permission
Leah obtains written approval from the chief executive and the loan system owner. The approval names her, the systems in scope, the dates and the activities allowed. Felix explains that even staff reviewing their own employer's systems need permission, because reviews can touch sensitive data, disrupt services or breach supplier contracts. The approval also protects Leah if anyone questions her actions. She asks the loan system vendor to confirm that reading configuration screens does not breach the support contract. She files the approval with her notes.
2.3 Safe handling of member data
Loan applications include payslips, bank statements and identity documents. Leah's review does not need any of them. Where screens show member data, she uses a test application created by the vendor with fictitious details. When taking screenshots of settings, she checks that no member information appears. Her notes are stored in a restricted folder and will be deleted after the review is accepted. Felix stresses that a security review must never become a new source of data exposure. She confirms this approach with the system owner first.
2.4 Stop conditions
Felix asks Leah to define when she will stop and report immediately. She lists three conditions: finding signs that someone else has already broken in, finding member documents exposed to the internet and causing any disruption to the loan service. In each case she will stop, tell the system owner and the chief executive, and not investigate further alone. Clear stop conditions protect members and keep the reviewer from wandering into incident response work that needs different skills and authority.
2.5 A finding under scope
During the review, Leah finds that document uploads are stored in a cloud folder whose sharing setting allows anyone with the link to view files. This meets one of her stop conditions. She stops, informs the owner and chief executive, and the vendor changes the setting within the hour. The vendor checks access logs and finds no access by unknown parties. Leah records the event, the response and the evidence. Her scope, permission and stop conditions made the response quick, calm and properly documented.
Worked example
Leah scopes a loan system review, obtains written permission, uses fictitious test data, defines three stop conditions and handles a link-sharing finding correctly.
Synthetic case. The loan system and events are synthetic.
Errors and limits
Scopes can exclude where problems lie. Vendor logs may not show all access.
Exercises
- EX014 — Excluded systems. Which systems did the scope exclude? Rubric: 3 = core banking run by a service bureau and the card processor;; 2 = both;; 1 = vague;; 0 = none.
- EX015 — Not allowed. Which activities were outside Leah's permission? Rubric: 3 = attempting attacks or accessing member files;; 2 = attacks;; 1 = interviews;; 0 = none.
- EX016 — Approvers. Who approved Leah's review in writing? Rubric: 3 = the chief executive and the loan system owner;; 2 = both;; 1 = vague;; 0 = none.
- EX017 — Vendor check. What did Leah confirm with the vendor? Rubric: 3 = that reading configuration screens does not breach the support contract;; 2 = contract;; 1 = vague;; 0 = none.
- EX018 — Test application. How did Leah avoid seeing real member data? Rubric: 3 = used a vendor test application with fictitious details;; 2 = test data;; 1 = vague;; 0 = none.
- EX019 — Screenshot care. What did Leah check before saving screenshots? Rubric: 3 = that no member information appears;; 2 = no data;; 1 = vague;; 0 = none.
- EX020 — Three stop triggers. Which three conditions make Leah stop? Rubric: 3 = signs of a break-in, member documents exposed online, disruption to the service;; 2 = two;; 1 = vague;; 0 = none.
- EX021 — Why stop. Why should a reviewer stop rather than investigate alone? Rubric: 3 = incident response needs different skills and authority;; 2 = authority;; 1 = vague;; 0 = none.
- EX022 — Upload finding. What exposure did the review find? Rubric: 3 = uploads in a cloud folder viewable by anyone with the link;; 2 = link sharing;; 1 = vague;; 0 = none.
- EX023 — Vendor log result. What did the vendor's access logs show? Rubric: 3 = no access by unknown parties;; 2 = none found;; 1 = breach;; 0 = none.
- EX024 — Notes retention. When are Leah's review notes deleted? Rubric: 3 = after the review is accepted;; 2 = after acceptance;; 1 = never;; 0 = none.
- EX025 — Response speed. How quickly did the vendor fix the sharing setting? Rubric: 3 = within the hour;; 2 = hour;; 1 = vague;; 0 = none.
- EX026 — Review exposure. What must a security review never become? Rubric: 3 = a new source of data exposure;; 2 = exposure;; 1 = vague;; 0 = none.
Synthesis
Scope, permission, safe data handling and stop conditions make reviews useful and safe.
Continue studying — chapter 02 of 04
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →