◇ OpenCyber Academy
Rapid course · Chapter 4 · English

Chapter 4 — Week 4: Keep it going and respond calmly

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Week 4: Keep it going and respond calmly

Lesson map

Lesson 04 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Re-running the check"]
  N2["4.2 A monthly routine"]
  N3["4.3 When something goes wrong"]
  N4["4.4 Joiners and leavers"]
  N5["4.5 What remains"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Re-running the check"]
  N2["4.2 A monthly routine"]
  N3["4.3 When something goes wrong"]
  N4["4.4 Joiners and leavers"]
  N5["4.5 What remains"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX039"]

[Learning outcomes]
    |
    v
[4.1 Re-running the check]
    |
    v
[4.2 A monthly routine]
    |
    v
[4.3 When something goes wrong]
    |
    v
[4.4 Joiners and leavers]
    |
    v
[4.5 What remains]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) re-run the quick check; (2) set a monthly routine; (3) prepare simple incident steps.

4.1 Re-running the check

Leah repeats the five-point quick check with the same method. All twelve laptops now pass all five, compared with three of twelve at the start. She records the result with the date and shares a one-page summary with the trustees: what was found, what was changed and what it cost, which was only her time.

Using the same method matters: the before and after figures are comparable only because the five checks and their yes or no answers did not change. The summary also tells the trustees what the theft would mean now: an encrypted laptop with files in the cloud, a recovery key on record and a dated spreadsheet row.

4.2 A monthly routine

Improvements fade without routine. Leah writes a fifteen-minute monthly checklist: run the quick check on each laptop, confirm updates are current, check that no one has become an administrator, look at the cloud service's sign-in alerts, and restore one file. A second volunteer is trained to do it when Leah is away.

Each item checks that a fix has not quietly undone itself: updates paused again, a volunteer given admin rights in a hurry, a sign-in alert ignored, or a backup that no longer restores. Restoring one file a month keeps the skill fresh as well as testing the service. The trustees asked for a two-line update at each meeting, which the routine's record makes easy.

4.3 When something goes wrong

Leah writes four short responses on one page. Lost or stolen laptop: tell Leah, who confirms encryption, signs the user out everywhere and changes their password. Suspicious email clicked: change the password, check MFA prompts and tell Leah. Antivirus warning: disconnect from Wi-Fi and call Leah. Account locked out: Leah verifies the person by phone before resetting. NIST SP 800-61 describes incident handling in detail, but a small charity needs simple first steps that anyone can follow.

Each response is something a volunteer can do without IT knowledge, and each ends with Leah. For a stolen laptop, the first question is the one nobody could answer last month: was it encrypted? The spreadsheet now answers it at once.

4.4 Joiners and leavers

New volunteers get a standard account, MFA set up in person and a two-minute talk on saving files to the cloud. Leavers return laptops, and their accounts are disabled the same day.

The leavers step closes the gap the food bank had before: accounts that stay active after someone stops volunteering. Disabling the account on the same day means a returned laptop cannot be used to reach the email, and a laptop that is never returned is encrypted and has no working account behind it. Leah notes each joiner and leaver in the device spreadsheet against the laptop they used. The monthly routine checks the list of active accounts against current volunteers, so a missed leaver is caught within a month.

4.5 What remains

Some things are beyond a month: replacing the oldest laptop, which will soon stop receiving updates, and considering a free device management service for charities. Leah lists them for the trustees with rough timings.

FB07, the old laptop that failed four of the five checks at the start, is the kind of device this covers. Once the oldest laptop stops receiving updates, the quick check will fail it every month whatever Leah does, so replacing it is a budget decision for the trustees, not an IT task. A device management service would replace the printed checklist if the food bank grows beyond twelve laptops.

Worked example

The trustees approve the monthly routine and ask for a two-line update at each meeting. Leah's final note shows 12 of 12 laptops passing all five checks, the date, and the two remaining items.

Synthetic case. Figures are synthetic.

Errors and limits

A routine kept in one person's head stops when they leave; write it down and train a second person.

Exercises

Synthesis

In one month, Leah moved the food bank from not knowing to knowing, with simple routines that keep the basics in place.

Continue studying — chapter 04 of 04

← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →