OpenCyber Academy
Technical · Chapter 4 · English
Course code: OCA-050Chapter 04: OCA-050-C004

Chapter 4 — Scripting and data formats

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Common formats"]
  N2["4.2 Minimal output"]
  N3["4.3 Validating input"]
  N4["4.4 Handling files"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Common formats"]
  N2["4.2 Minimal output"]
  N3["4.3 Validating input"]
  N4["4.4 Handling files"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[4.1 Common formats]
    |
    v
[4.2 Minimal output]
    |
    v
[4.3 Validating input]
    |
    v
[4.4 Handling files]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) read CSV and JSON exports safely; (2) write scripts that minimise output; (3) validate data before processing.

4.1 Common formats

Marlow's systems export data as CSV files for spreadsheets and JSON for system interfaces. Leila practises reading both with Python's standard csv and json modules, using synthetic patient records. She notes that CSV files are easily opened in spreadsheets and emailed, so they spread quickly, while JSON exports often contain more fields than anyone looks at. In one synthetic JSON export, she finds a medical history field nested inside the appointment object, even though the booking report needs only times and clinic codes.

4.2 Minimal output

Leila writes a script that counts appointments per clinic per day for capacity planning. Her first version prints the full appointment rows while debugging. She rewrites it to output only counts and to write debugging details to a temporary file that is deleted at the end. Mr. Okafor explains that outputs from scripts often end up in tickets, chat messages and email, so a script that prints patient names can create a disclosure even when nobody intended to share anything. Only aggregate counts leave the script.

4.3 Validating input

Before processing an export, Leila's script checks that the file has the expected columns and rejects files with unexpected ones such as medical_history or date_of_birth. It also checks that dates parse correctly and that clinic codes are between one and eight. When validation fails, the script stops with a clear message instead of guessing. She explains that validation enforces minimisation at the point where data enter a tool, and it also catches export mistakes before they produce misleading reports.

4.4 Handling files

Leila's scripts read exports from a restricted folder and never copy them to desktops or personal drives. Temporary files use Python's tempfile module and are removed when the script ends. She adds a note at the top of each script explaining what data it reads, why and what it outputs. Mr. Okafor reviews the scripts and asks her to remove an unused import of a third-party plotting library, keeping the tools dependent on the standard library only, which simplifies review and maintenance.

Worked example

Leila reads CSV and JSON exports, finds an unnecessary nested medical history field, writes a count-only capacity script, validates columns and values, and handles files only in a restricted folder.

Synthetic case. Exports are synthetic.

Errors and limits

Validation rules need updating when systems change their export formats.

Exercises

Worked answers

EX013. A medical history field nested inside each appointment object.

EX014. Outputs are copied into tickets, chats and emails, creating disclosures.

EX015. It stops with a clear message rather than guessing.

EX016. Created with tempfile and removed when the script ends.