◇ OpenCyber Academy
Technical · Chapter 5 · English

Chapter 5 — Security scope and evidence

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Defining scope"]
  N2["5.2 Authorisation"]
  N3["5.3 Evidence collection"]
  N4["5.4 Integrity of evidence"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Defining scope"]
  N2["5.2 Authorisation"]
  N3["5.3 Evidence collection"]
  N4["5.4 Integrity of evidence"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Defining scope]
    |
    v
[5.2 Authorisation]
    |
    v
[5.3 Evidence collection]
    |
    v
[5.4 Integrity of evidence]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of a technical check; (2) obtain authorisation; (3) collect and store evidence properly.

5.1 Defining scope

Before Leila checks any Marlow system, Mr. Okafor requires a written scope: which systems, which clinics, which dates, what methods and what is excluded. For her first check, the scope covers account settings and network zones in the pilot clinic, using synthetic patient records in a test copy of the practice-management system. Live patient records and the vendor's cloud infrastructure are excluded. He explains that clear scope protects patients, Marlow and Leila herself, because work outside scope can cause harm or break contracts.

5.2 Authorisation

The scope is signed by Marlow's operations director and the data protection officer. The practice-management vendor is informed because its terms forbid testing without notice. Leila keeps the signed scope with her notes and carries a copy during clinic visits. When a practice manager asks her to look at a live record to explain a problem, she declines and asks for the issue to be reproduced with synthetic data, recording the request and her answer in her log. Her log also records who approved each step.

5.3 Evidence collection

Leila records each finding with the date, time, system, method, what she observed and a screenshot or command output taken from the test environment. She avoids capturing real patient data in screenshots by using synthetic records and cropping irrelevant parts. Evidence is stored in a restricted folder with access for her, Mr. Okafor and the data protection officer. She explains that evidence must allow someone else to repeat the check and reach the same result. File names follow a fixed pattern of date, clinic and check name, so evidence can be found quickly.

5.4 Integrity of evidence

To show that evidence has not been changed, Leila calculates a SHA-256 hash of each evidence file using Python's hashlib and records the hashes in a log. When the data protection officer later reviews the findings, she recalculates two hashes and they match. Mr. Okafor notes that hashing does not protect confidentiality, only integrity, and that evidence containing personal data must still be protected and deleted when no longer needed, following the same retention rules as other records. The hash log is itself stored read-only.

Worked example

Leila writes a signed scope excluding live records, informs the vendor, declines an out-of-scope request, records findings with method and time, and hashes evidence files.

Synthetic case. Scope and evidence are synthetic.

Errors and limits

Scope creep happens gradually; recheck the scope before each new task.

Exercises

Continue studying — lesson 05 (chapter 05 of 18)

← Chapter 04 · Course chapter index · Chapter 06 →

Continue to the next authored lesson.