Security governance, risk and compliance: guided lab and applied synthesis

Lesson map

Lesson 04 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Running the exercise"]
  N2["4.2 Reading the timings"]
  N3["Lab — Timing the Northstar restore exercise"]
  N4["4.3 What the result means"]
  N5["4.4 Recording the decision"]
  N6["4.5 Updating the one-page strategy"]
  N7["Concepts — two calculations, and a reading that is n"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Running the exercise"]
  N2["4.2 Reading the timings"]
  N3["Lab — Timing the Northstar restore exercise"]
  N4["4.3 What the result means"]
  N5["4.4 Recording the decision"]
  N6["4.5 Updating the one-page strategy"]
  N7["Concepts — two calculations, and a reading that is n"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX057"]

[Learning outcomes]
    |
    v
[4.1 Running the exercise]
    |
    v
[4.2 Reading the timings]
    |
    v
[Lab — Timing the Northstar restore exercise]
    |
    v
[4.3 What the result means]
    |
    v
[4.4 Recording the decision]
    |
    v
[4.5 Updating the one-page strategy]
    |
    v
[Concepts — two calculations, and a reading that is n]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes

You will (1) run and time a restore exercise safely; (2) compare the result with the service target and find the critical delay; (3) write a short decision record and an updated one-page strategy.

4.1 Running the exercise

With scope, permission and the dependency map in place, Northstar runs the timed restore exercise promised in Chapter 1. The plan from Chapter 2 is followed: an isolated test environment, outbound email blocked, a named person able to stop the exercise and success defined in advance as front-desk staff making test bookings in the restored portal. The security engineer records each step with start and finish times. The operations director attends the start and the end, because the result will test the four-hour interruption limit that was still a working assumption. Nobody touches the live portal during the exercise.

4.2 Reading the timings

The lab adds the recorded steps. Declaring the exercise and isolating the test copy took fifteen minutes. Locating the backup and the credentials took fifty-five. Restoring the scheduling database took seventy. Rebuilding the web host configuration took sixty. Reconnecting the identity provider took twenty-five, and the front-desk test bookings took twenty. The total was two hundred and forty-five minutes, missing the two-hundred-and-forty-minute target by five minutes. The database restore was the longest step, but the most surprising was the fifty-five minutes spent finding the backup and credentials, which is a governance gap rather than a technical limit.

Lab — Timing the Northstar restore exercise

"""Timed restore exercise for the Northstar appointment portal against a four-hour target."""
steps = [("declare exercise and isolate test copy", 15), ("locate backup and credentials", 55),
         ("restore scheduling database", 70), ("rebuild web host configuration", 60),
         ("reconnect identity provider", 25), ("front-desk test bookings", 20)]
t = 0
for s, m in steps:
    t += m; print(f"{s}: {m} min (cumulative {t} min)")
print(f"total {t} min = {t/60:.2f} h; target 240 min; {'MET' if t <= 240 else 'MISSED by ' + str(t-240) + ' min'}")
slow = max(steps, key=lambda x: x[1]); print(f"longest step: {slow[0]} ({slow[1]} min)")

Run with python3 lab_restore.py. Verified output:

declare exercise and isolate test copy: 15 min (cumulative 15 min)
locate backup and credentials: 55 min (cumulative 70 min)
restore scheduling database: 70 min (cumulative 140 min)
rebuild web host configuration: 60 min (cumulative 200 min)
reconnect identity provider: 25 min (cumulative 225 min)
front-desk test bookings: 20 min (cumulative 245 min)
total 245 min = 4.08 h; target 240 min; MISSED by 5 min
longest step: restore scheduling database (70 min)

4.3 What the result means

Missing the target by five minutes does not mean the strategy failed; it means the evidence now replaces an assumption. Three improvements are clear. Keeping restore instructions and access to the backup credentials in a known, protected location could save most of the fifty-five minutes. Documenting the web host configuration as a script could shorten the rebuild. Adding the identity provider reconnection to the written procedure removes guesswork. The team also notes limits: one exercise, under calm conditions, with people who knew it was coming. A real event at night, with attackers possibly still present, would be slower. The four-hour limit should therefore be confirmed only after a second exercise.

4.4 Recording the decision

Northstar writes a short decision record for the operations director. It states the decision needed, the evidence, the options and the recommendation. The decision is whether to accept a four-hour interruption limit for the appointment portal. The evidence is the exercise log. The options are to accept the limit now, to accept it after improvements and a second test, or to raise the limit to six hours and staff a manual booking process. The recommendation is the second option, with improvements due within thirty days and a second exercise booked. The operations director approves it and the record is filed with the evidence, so the reasoning can be checked later.

4.5 Updating the one-page strategy

The chapter closes by updating the six-sentence strategy test from Chapter 1. The priority service is still appointment scheduling for clients and front-desk staff. The impact limit is now an evidence-based proposal rather than a guess. The leading scenarios include identity provider failure, revealed by the dependency map. The quarter's outcomes are the three restore improvements, a second timed exercise, owners for the email relay and roster and removal of appointment reasons from emails. The operations director owns the trade-offs. Signals to review monthly are restore time, backup failures, privileged changes and overdue owner actions. The strategy is shorter than many security plans, but every line is now tied to evidence or an approved assumption.

Worked example

Northstar runs a safe timed restore taking 245 minutes against a 240-minute target, identifies a 55-minute governance delay, records an approved decision to improve and retest, and updates its one-page strategy.

Synthetic case. The exercise and timings are fictional and use synthetic data in an isolated environment.

Errors and limits

One calm, announced exercise overstates real readiness. Timings depend on who is available. A missed target by minutes can tempt teams to adjust the target instead of the process.

Concepts — two calculations, and a reading that is neither

Two calculations share the six minute values and answer different questions. The running total is compared with the target by a less-than-or-equal test. The longest step is chosen by looking only at each step's own minutes, ignoring that running total. A governance reading of the search for instructions is a third question, and neither calculation labels it. Rewriting one addend on paper can flip the comparison without isolating a copy, blocking mail, or seating the front desk again.

Lesson table; scroll horizontally to read all columns →

The book says a known protected location for the instructions and the backup credentials could save most of the 55 minutes. It does not state a measured saving. Do not invent one.

Decision flow — sum, maximum, pencil

flowchart TD
  A["The published step log"] --> B["Add the six minute values into a running total"]
  B --> C{"Is the total less than or equal to 240?"}
  C -->|245| D["Print MISSED by 5"]
  B --> E["Select the largest minute value"]
  E --> F["70 minutes: restore the scheduling database"]
  F --> G["55 minutes is the governance gap and is not the maximum"]
  D --> H{"Did someone rewrite 55 as 50 on paper?"}
  H -->|Yes| I["The same addition would print MET"]
  I --> J["That rewrite is not a second exercise"]
  J --> K["Confirm four hours only after the improvements and a retest"]

Worked example — a pencil on the 55

Someone copies the six published lines onto a notepad and changes the locate step from 55 to 50, leaving 15, 70, 60, 25 and 20 untouched. The new sum is 240, so the same comparison would print MET. The pencil mark isolated nothing, blocked no mail, and the front desk made no fresh bookings. The four-hour limit therefore stays an evidence-based proposal until the three improvements exist and a retest is run. A single rehearsed afternoon still flatters the night shift, whatever word a later total happens to print. Editing the notepad so the comparison smiles repeats a shortcut the director already refused.

Synthetic case. The pencil change from 55 to 50 is arithmetic on the published log. It is not a second run, and it is not a measured saving.

Apply

• EX057 — What the program actually compared. The exercise total is 245 and the target test is t <= 240. What does the program print, which step does the maximum select, and which delay is the governance gap?
  Show marking criteria

  Rubric: 3 = it prints MISSED by 5; the maximum selects restoring the scheduling database at 70 minutes; the governance gap is the 55-minute search, which is not the maximum;; 2 = missed by five, and the database step is longest;; 1 = the 55-minute step is the maximum;; 0 = none.
• EX058 — Fifty instead of fifty-five. If the locate step were 50 rather than 55, the same addition would print MET. Does that confirm the four-hour limit?
  Show marking criteria

  Rubric: 3 = no; it is arithmetic on the published log, not a second exercise; the limit is confirmed only after the improvements and a retest; one calm announced exercise still overstates readiness;; 2 = no, a retest is still required;; 1 = yes, the sum now meets the target;; 0 = none.

Exercises

• EX036 — Success definition. How was success defined before the exercise?
  Show marking criteria

  Rubric: 3 = front-desk staff making test bookings in the restored portal;; 2 = bookings;; 1 = vague;; 0 = none.
• EX037 — Director presence. Why did the operations director attend the start and end?
  Show marking criteria

  Rubric: 3 = the result tests the four-hour assumption the director owns;; 2 = ownership;; 1 = vague;; 0 = none.
• EX038 — Total time. What total time did the exercise take?
  Show marking criteria

  Rubric: 3 = 245 minutes;; 2 = 4.08 hours;; 1 = 240;; 0 = none.
• EX039 — Target gap. By how much did the exercise miss the target?
  Show marking criteria

  Rubric: 3 = five minutes;; 2 = 5;; 1 = vague;; 0 = none.
• EX040 — Longest step. Which step took longest?
  Show marking criteria

  Rubric: 3 = restoring the scheduling database, 70 minutes;; 2 = database;; 1 = vague;; 0 = none.
• EX041 — Governance delay. Which delay was a governance gap rather than a technical limit?
  Show marking criteria

  Rubric: 3 = 55 minutes locating backup and credentials;; 2 = locating;; 1 = vague;; 0 = none.
• EX042 — Three improvements. Name the three improvements identified.
  Show marking criteria

  Rubric: 3 = known protected location for instructions and credentials, scripted web host configuration, identity step in procedure;; 2 = three;; 1 = vague;; 0 = none.
• EX043 — Calm conditions. Why might a real event be slower than the exercise?
  Show marking criteria

  Rubric: 3 = it may be at night with attackers present and no warning;; 2 = conditions;; 1 = vague;; 0 = none.
• EX044 — Second exercise. When should the four-hour limit be confirmed?
  Show marking criteria

  Rubric: 3 = after a second exercise following improvements;; 2 = retest;; 1 = now;; 0 = none.
• EX045 — Decision options. What three options did the decision record offer?
  Show marking criteria

  Rubric: 3 = accept now, accept after improvement and retest, raise to six hours with manual booking;; 2 = three;; 1 = vague;; 0 = none.
• EX046 — Recommended option. Which option was recommended and approved?
  Show marking criteria

  Rubric: 3 = accept after improvements within thirty days and a second test;; 2 = second option;; 1 = vague;; 0 = none.
• EX047 — Record filing. Why is the decision record filed with the evidence?
  Show marking criteria

  Rubric: 3 = so the reasoning can be checked later;; 2 = traceability;; 1 = vague;; 0 = none.
• EX048 — New scenario. Which scenario entered the strategy from the dependency map?
  Show marking criteria

  Rubric: 3 = identity provider failure;; 2 = identity;; 1 = vague;; 0 = none.
• EX049 — Monthly signals. List the signals reviewed monthly.
  Show marking criteria

  Rubric: 3 = restore time, backup failures, privileged changes, overdue owner actions;; 2 = four;; 1 = vague;; 0 = none.
• EX050 — Adjusting targets. What temptation should the team resist after missing by minutes?
  Show marking criteria

  Rubric: 3 = changing the target instead of the process;; 2 = resist;; 1 = vague;; 0 = none.

Synthesis

A safe, timed exercise turns an assumed service limit into evidence, a recorded decision and a sharper one-page strategy for the next quarter.

Continue studying — lesson 04 (chapter 04 of 20)

← Chapter 03 · Course chapter index · Chapter 05 →

Continue to the next authored lesson.