Chapter 2 — Scope, permission and safe practice
Lesson map
Lesson 02 published. Map, example, EX014.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Why scope matters"]
N2["2.2 Acting only with permission"]
N3["2.3 Working safely"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX014"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Why scope matters"]
N2["2.2 Acting only with permission"]
N3["2.3 Working safely"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX014"]
[Learning outcomes]
|
v
[2.1 Why scope matters]
|
v
[2.2 Acting only with permission]
|
v
[2.3 Working safely]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX014]
Learning outcomes
You will (1) set a written scope for any security review; (2) act only with permission; (3) work safely with synthetic data.
2.1 Why scope matters
Elena wants the café's IT contractor to review the vendor's proposal and test system. Mr Otieno explains that every security activity needs a written scope: which systems, what activities, what dates, which data, and who to contact. The scope for Copperleaf covers the vendor's test environment, read-only access to configuration and documentation, and synthetic customer data. It excludes the live ledger, any real customer data and the vendor's other clients. A clear scope protects Copperleaf, the vendor and the contractor, and prevents well-meaning work from causing harm or breaking agreements.
2.2 Acting only with permission
Permission must come from someone entitled to give it. The vendor owns the test environment, so the vendor signs the scope alongside Elena. The contractor agrees to stop and report if he finds anything outside scope, rather than investigating. Mr Otieno stresses that testing systems without permission can be unlawful even with good intentions, and that responsible practice means reporting problems privately to the owner and giving them time to fix them. Elena adds a clause asking the vendor to confirm in writing when reported issues are fixed.
2.3 Working safely
Safe practice means the review cannot hurt anyone. All testing uses synthetic customers and points with no value. Test keys are separate from any real keys and clearly labelled. Findings are stored in a restricted folder, and reports describe weaknesses in general terms without step-by-step instructions that could be misused. The contractor keeps a log of what he did and when. Elena learns that these habits are standard in professional security work, and that asking a vendor or contractor whether they follow them is itself a useful test of their maturity.
Worked example
Elena and the vendor sign a scope limited to the test environment and synthetic data, with stop-and-report and written confirmation of fixes.
Synthetic case. The scope, contractor and vendor are synthetic.
Errors and limits
Testing a system without its owner's written permission can be unlawful even if well meant.
Exercises
- EX014 — Scope elements. Name one element of a written scope. Rubric: 3 = which systems;; 2 = what dates;; 1 = favourite tools;; 0 = none.
- EX015 — Included systems. What does Copperleaf's scope include? Rubric: 3 = the vendor's test environment and documentation;; 2 = test environment;; 1 = the live ledger;; 0 = none.
- EX016 — Excluded systems. What does the scope exclude? Rubric: 3 = the live ledger and real customer data;; 2 = live systems;; 1 = documentation;; 0 = none.
- EX017 — Permission signer. Who must sign alongside Elena? Rubric: 3 = the vendor, who owns the environment;; 2 = vendor;; 1 = a customer;; 0 = none.
- EX018 — Out-of-scope finding. What should the contractor do with out-of-scope discoveries? Rubric: 3 = stop and report;; 2 = report;; 1 = investigate;; 0 = none.
- EX019 — Unpermitted testing. Why avoid testing without permission? Rubric: 3 = it can be unlawful even with good intent;; 2 = unlawful;; 1 = slow;; 0 = none.
- EX020 — Fix confirmation. What clause does Elena add? Rubric: 3 = vendor confirms fixes in writing;; 2 = written fix confirmation;; 1 = vague;; 0 = none.
- EX021 — Test data. What data is used in testing? Rubric: 3 = synthetic customers and points with no value;; 2 = synthetic;; 1 = real customers;; 0 = none.
- EX022 — Key separation. How are test keys handled? Rubric: 3 = separate from real keys and clearly labelled;; 2 = labelled;; 1 = shared;; 0 = none.
- EX023 — Report style. How are weaknesses described in reports? Rubric: 3 = in general terms without misusable steps;; 2 = general;; 1 = full instructions;; 0 = none.
- EX024 — Contractor log. What record does the contractor keep? Rubric: 3 = a log of what he did and when;; 2 = activity log;; 1 = vague;; 0 = none.
- EX025 — Maturity test. What does asking about safe practice reveal? Rubric: 3 = the vendor's or contractor's maturity;; 2 = maturity;; 1 = price;; 0 = none.
- EX026 — Findings storage. Where are findings stored? Rubric: 3 = a restricted folder;; 2 = restricted;; 1 = public drive;; 0 = none.
Synthesis
Written scope, proper permission and safe practice make a security review trustworthy.
Continue studying — chapter 02 of 04
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →