## Chapter 5 — Security scope and evidence ### Lesson map Lesson 05 published. Map, example, EX017. ```mermaid flowchart TD N0["Learning outcomes"] N1["5.1 Defining scope"] N2["5.2 Collecting evidence"] N3["5.3 Findings and opinions"] N4["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 N4 --> EX["Worked example"] EX --> Q["Exercise EX017"] ``` ### Logical drawing ```mermaid flowchart LR N0["Learning outcomes"] N1["5.1 Defining scope"] N2["5.2 Collecting evidence"] N3["5.3 Findings and opinions"] N4["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX017"] ``` ```text [Learning outcomes] | v [5.1 Defining scope] | v [5.2 Collecting evidence] | v [5.3 Findings and opinions] | v [Synthesis] | v [Worked example] --> [Exercise EX017] ``` ### Learning outcomes You will (1) define the scope of a security review; (2) collect evidence properly; (3) separate findings from opinions. ### 5.1 Defining scope Grace asks Nadia to review security at the Elmfield practice. Before starting, Nadia writes a scope: the practice network, PCs, imaging server, router and card terminals; excluded are the cloud practice management system, which the vendor manages, and the payment provider's systems. She lists what she may do: read configurations, interview staff and run approved checks, but not test attacks. Grace signs the scope. A written scope protects the reviewer, sets expectations and prevents work drifting into systems she has no permission to touch. ### 5.2 Collecting evidence For each check, Nadia records what she looked at, when, how and what she found, with screenshots or exported settings. She notes the router firmware version, the imaging server's open shares and the PCs' update status. When a receptionist says passwords are kept on a sticky note, Nadia records it as a statement and checks it herself by asking to see the reception desk. Evidence that others can verify is the basis of a credible review, and recording sources makes later disagreements easier to settle. ### 5.3 Findings and opinions Nadia's report separates findings, which are facts backed by evidence, from opinions, which are her judgement about risk and priority. A finding: the imaging server shares a folder readable by everyone on the network. An opinion: this is the highest priority because imaging is critical and the network is flat. Keeping them apart lets Grace check the facts and then weigh the judgement herself. Daniel notes that reviewers lose trust when opinions are presented as facts, even if the opinions are reasonable. ### Worked example Nadia writes a signed scope for Elmfield, collects verifiable evidence and separates findings from opinions in her report. > **Synthetic case.** The review is synthetic. ### Errors and limits Scopes can exclude where problems lie. Statements need checking before they become findings. ### Exercises - **EX017 — Exclusions.** What did the scope exclude? *Rubric:* 3 = the cloud practice management system and the payment provider's systems;; 2 = both;; 1 = vague;; 0 = none. - **EX018 — Not permitted.** What was Nadia not permitted to do? *Rubric:* 3 = test attacks;; 2 = attacks;; 1 = interviews;; 0 = none. - **EX019 — Sticky note.** How did Nadia handle the sticky note claim? *Rubric:* 3 = recorded it as a statement and checked it herself;; 2 = verify;; 1 = ignored;; 0 = none. - **EX020 — Finding example.** Give a finding from Nadia's report. *Rubric:* 3 = the imaging server shares a folder readable by everyone;; 2 = share;; 1 = vague;; 0 = none. ### Synthesis A signed scope, verifiable evidence and a clear split between findings and opinions make a review credible. ### Continue studying — chapter 05 of 18 [← Chapter 04 (draft)](#ch-04) · [Course chapter index](../SUBJECTS.md) · [Chapter 06 (draft) →](#ch-06) ## Worked answers **EX017.** The vendor-managed practice management system and the payment provider's systems. **EX018.** Test attacks; she could only read configurations, interview staff and run approved checks. **EX019.** She recorded it as a statement and then verified it by looking at the reception desk. **EX020.** The imaging server shares a folder readable by everyone on the network.