Chapter 5 — Security scope and evidence | Technical Security architecture and engineering

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Defining scope"]
  N2["5.2 Collecting evidence"]
  N3["5.3 Findings and opinions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Defining scope"]
  N2["5.2 Collecting evidence"]
  N3["5.3 Findings and opinions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Defining scope]
    |
    v
[5.2 Collecting evidence]
    |
    v
[5.3 Findings and opinions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of a security review; (2) collect evidence properly; (3) separate findings from opinions.

5.1 Defining scope

Grace asks Nadia to review security at the Elmfield practice. Before starting, Nadia writes a scope: the practice network, PCs, imaging server, router and card terminals; excluded are the cloud practice management system, which the vendor manages, and the payment provider's systems. She lists what she may do: read configurations, interview staff and run approved checks, but not test attacks. Grace signs the scope. A written scope protects the reviewer, sets expectations and prevents work drifting into systems she has no permission to touch.

5.2 Collecting evidence

For each check, Nadia records what she looked at, when, how and what she found, with screenshots or exported settings. She notes the router firmware version, the imaging server's open shares and the PCs' update status. When a receptionist says passwords are kept on a sticky note, Nadia records it as a statement and checks it herself by asking to see the reception desk. Evidence that others can verify is the basis of a credible review, and recording sources makes later disagreements easier to settle.

5.3 Findings and opinions

Nadia's report separates findings, which are facts backed by evidence, from opinions, which are her judgement about risk and priority. A finding: the imaging server shares a folder readable by everyone on the network. An opinion: this is the highest priority because imaging is critical and the network is flat. Keeping them apart lets Grace check the facts and then weigh the judgement herself. Daniel notes that reviewers lose trust when opinions are presented as facts, even if the opinions are reasonable.

Worked example

Nadia writes a signed scope for Elmfield, collects verifiable evidence and separates findings from opinions in her report.

Synthetic case. The review is synthetic.

Errors and limits

Scopes can exclude where problems lie. Statements need checking before they become findings.

Exercises

EX017 — Exclusions. What did the scope exclude?
Show marking criteria
Rubric: 3 = the cloud practice management system and the payment provider's systems;; 2 = both;; 1 = vague;; 0 = none.
EX018 — Not permitted. What was Nadia not permitted to do?
Show marking criteria
Rubric: 3 = test attacks;; 2 = attacks;; 1 = interviews;; 0 = none.
EX019 — Sticky note. How did Nadia handle the sticky note claim?
Show marking criteria
Rubric: 3 = recorded it as a statement and checked it herself;; 2 = verify;; 1 = ignored;; 0 = none.
EX020 — Finding example. Give a finding from Nadia's report.
Show marking criteria
Rubric: 3 = the imaging server shares a folder readable by everyone;; 2 = share;; 1 = vague;; 0 = none.

Synthesis

A signed scope, verifiable evidence and a clear split between findings and opinions make a review credible.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →