◇ OpenCyber Academy
Technical · Chapter 5 · English

Chapter 5 — Security scope and evidence

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Scope"]
  N2["5.2 Evidence"]
  N3["5.3 Recording handling"]
  N4["5.4 Authorisation"]
  N5["5.5 Privacy"]
  N6["5.6 Handing over"]
  N7["Customer communication"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Scope"]
  N2["5.2 Evidence"]
  N3["5.3 Recording handling"]
  N4["5.4 Authorisation"]
  N5["5.5 Privacy"]
  N6["5.6 Handing over"]
  N7["Customer communication"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Scope]
    |
    v
[5.2 Evidence]
    |
    v
[5.3 Recording handling]
    |
    v
[5.4 Authorisation]
    |
    v
[5.5 Privacy]
    |
    v
[5.6 Handing over]
    |
    v
[Customer communication]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of a support or security task; (2) collect evidence carefully; (3) record the chain of handling; (4) stay within authorisation.

5.1 Scope

Every task has a scope: which customer, which systems, what actions are allowed. Tomás works only on systems named in the ticket, with the customer's consent recorded. For Ferncroft, the ticket named the customer's site, the resize plugin and its files, the server logs and the permission check. Looking at other customers' sites that ran the same plugin needed a separate ticket and approval, even though the risk seemed similar. The consent recorded in the ticket is what lets Tomás copy Ferncroft's logs and files at all.

5.2 Evidence

In the Ferncroft case, evidence includes the plugin files, their hashes, server logs, the permission listing and customer screenshots. Evidence is copied before anything is changed. Copying first matters because the security team restored correct permissions on the plugin folder. Had they done so before taking a copy, the evidence that the folder was writable would have been lost. Grace's review counted seven evidence items for Ferncroft, each with its hash and the time it was collected. Screenshots from customers count as evidence too, so they are saved with their dates.

5.3 Recording handling

Each item has a note: what it is, who collected it, when, and its hash. This lets others trust that the evidence was not altered. The hash in the note is what makes later trust possible. If the security team computes the same hash on the plugin copy weeks later, they know it is the file Tomás collected. A missing time or collector name would leave a gap that a customer or reviewer could reasonably question. The notes travel with the files, so a copy without its note is treated as unverified.

5.4 Authorisation

Investigating beyond scope, such as looking at another customer's site "just in case", needs a new ticket and approval. The temptation is real when the same resize plugin might be installed elsewhere. Yet another customer's site belongs to that customer, and their consent is not in the Ferncroft ticket. A new ticket records the reason and approval, and the inventory built in Chapter 9 later makes such searches routine and authorised. Approval comes from Grace or the security team, not from the technician's own judgement of risk.

5.5 Privacy

Logs contain visitors' addresses; they are kept only as long as needed and shared only within the investigation. Ferncroft's server logs include addresses of shoppers who never did anything wrong. Tomás copies only the lines needed for the redirect investigation and keeps them with the evidence. The 30-day retention used for web logs at Pinecrest sets the default, and training examples use documentation addresses instead of real ones. Lines kept as evidence follow the case's retention period and are deleted with the rest of it.

5.6 Handing over

Tomás passes evidence to the security team with the notes, and keeps working on customer communication. Handing over with the notes means the security team does not need to ask Tomás what each file is. His continued role in customer communication keeps one person responsible for what Ferncroft hears. The split also keeps the investigation separate from support work that must continue meanwhile. Tomás's customer messages are reviewed by Grace before they are sent to Ferncroft's owner.

Customer communication

Evidence also supports what Pinecrest tells the customer. Tomás drafts a plain message for Grace to review: what visitors saw, what was found, what has been fixed, and what Ferncroft should do, such as changing administrator passwords as a precaution. The message avoids guesses and states only what the evidence shows. When the investigation later confirms the cause, a short follow-up explains it, and the customer thanks support for the clear updates.

Retention

Evidence is kept for the agreed period, then deleted.

Worked example

Grace reviews Tomás's evidence notes for Ferncroft: seven items, each with hash and time. The security team later confirms from the files that the mirror version added a redirect, and the notes support Pinecrest's message to the customer.

Synthetic case. Evidence is synthetic.

Errors and limits

Changing a system before copying evidence can destroy the facts needed later.

Exercises

Synthesis

Stay in scope and handle evidence carefully.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →