OpenCyber AcademyLesson map
Lesson 13. Map, example, EX067.
flowchart TD
R["Roster access has never been reviewed"] --> E["Evidence requested: the sharing list"]
E --> V{"Is the list in the file?"}
V -->|No| K["A guess about who can open it is not the list"]
V -->|Yes| S["The list would be the evidence"]
An assumption about departed volunteers stays an assumption until the list is read.
Logical drawing
roster spreadsheet
owner NONE
contact details of volunteers
access: never reviewed
requested evidence
the sharing list
|
+-- "about three people" is not the list
+-- a leaver's access is not stated as fact
+-- the spreadsheet is not edited
Learning outcomes
After this chapter, you should be able to:
- Keep the roster access review as something that has not happened.
- Refuse a guessed headcount in place of the sharing list.
- Leave a departed volunteer's access unasserted.
13.1 The scenario asked for a list. The file still does not hold one.
Wide sharing could expose the volunteers' contact details, and the access review the scenario called for has not been carried out. The evidence request is the sharing list. A classmate says only a handful of people can open the file, so the review can be marked done, and adds that leavers have already lost access. Chapter 1's roster scenario treated lingering access as an assumption to test, not as a fact. A handful is not the list, and this lesson does not count the people. The engineer does not edit the spreadsheet and does not write that any named volunteer was removed. No volunteer is named.
13.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Statement | Status in the file | Decision |
|---|---|---|
| Access has never been reviewed | Chapter 3 | May stay |
| The sharing list was requested | The evidence line | May stay as a request |
| "Only a handful still have it." | No list | Refuse |
| "Leavers are already removed." | An assumption, not a test | Do not state it as fact |
| Edit the sharing settings tonight | No owner, and no list | Refuse |
Synthetic case. No volunteer name and no headcount are supplied.
Errors and limits
Waiting for the list does not make wide sharing safe. It refuses a review that nobody has performed.
Apply
- EX067 — What would the list have shown? Roster access has never been reviewed, and the sharing list was the evidence asked for. A teammate says a handful of people remain and that leavers are already gone. What is still missing, and what do you not edit?
Show marking criteria
Rubric: 3 = the sharing list is not in the file; a guessed handful is not that list; lingering access stays an assumption; do not edit the spreadsheet; name no volunteer;; 2 = the list is missing and the sheet is not edited;; 1 = one of those;; 0 = none.