Chapter 5 — Security scope and evidence | Technical Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Scope of the work"]
  N2["5.2 Authorised activity"]
  N3["5.3 Gathering evidence"]
  N4["5.4 Evidence and privacy"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Scope of the work"]
  N2["5.2 Authorised activity"]
  N3["5.3 Gathering evidence"]
  N4["5.4 Evidence and privacy"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Scope of the work]
    |
    v
[5.2 Authorised activity]
    |
    v
[5.3 Gathering evidence]
    |
    v
[5.4 Evidence and privacy]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of technical security work; (2) gather evidence; (3) work within authorisation.

5.1 Scope of the work

Technical security work must have a defined scope: which systems, which tasks and which time. At Castleford, Amina's supervised tasks cover network devices, firewall rules, VPN settings, logs and certificates. They exclude tenant data and the housing system's internal configuration, which belong to the system's supplier. A written scope, agreed by Rosa and Leon, prevents misunderstandings and protects everyone. If a task seems to need something outside scope, Amina stops and asks before going further. The scope is reviewed whenever her tasks change, so it always reflects what she is actually doing.

5.2 Authorised activity

Some activities, such as testing whether a service responds, can disrupt systems or breach agreements if done without permission. Amina performs no testing against Castleford systems without Rosa's explicit approval for that specific activity and time. In labs, she uses synthetic data and isolated virtual machines. This boundary is a core professional rule. Many organisations have been disrupted by well-meaning staff running tools they did not fully understand on live networks. Approvals are recorded in the shared log with the date, the activity and the systems involved, so there is no doubt later about what was permitted.

5.3 Gathering evidence

Evidence is information others can check. Amina collects configuration exports, log extracts and screenshots of settings, each labelled with the date, the system and who provided it. She stores them in an agreed folder, not on personal devices. She avoids relying on what someone remembers about a setting, because memory is often wrong about details. When evidence conflicts, such as a diagram showing a firewall rule that the configuration does not contain, she reports the conflict rather than choosing one source.

5.4 Evidence and privacy

Logs can contain personal data, such as staff usernames, locations and times. Amina handles them under Castleford's data protection policy: using them only for security tasks, keeping them only as long as needed and sharing them only with people who need them. For course work, she uses synthetic logs that look realistic but describe no real person. Respecting privacy while gathering evidence is part of doing technical work responsibly, and it maintains staff trust in monitoring. Lab files are deleted when each exercise is finished and marked.

Worked example

Amina's scope document lists five in-scope areas, two exclusions and a rule to stop and ask when unsure.

Synthetic case. The scope is synthetic.

Errors and limits

Testing live systems without specific approval can disrupt services and breach trust.

Exercises

EX017 — Out-of-scope area. Name one area outside Amina's scope. Rubric: 3 = tenant data or housing system internals;; 2 = one;; 1 = vague;; 0 = none.
EX018 — Test approval. What approval does a test against Castleford need? Rubric: 3 = Rosa's explicit approval for activity and time;; 2 = approval;; 1 = vague;; 0 = none.
EX019 — Evidence label. What should label each piece of evidence? Rubric: 3 = date, system and provider;; 2 = date;; 1 = vague;; 0 = none.
EX020 — Conflicting sources. What should Amina do when two sources conflict? Rubric: 3 = report the conflict;; 2 = report;; 1 = pick one;; 0 = none.

Synthesis

Clear scope, authorised activity and careful evidence handling are the foundation of technical security work.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →