Chapter 12 — Contained laboratory I | Technical Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Contained laboratory I

Lesson map

Lesson 12 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Safe lab"]
  N2["12.2 Test procedure"]
  N3["12.3 Comparing"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Safe lab"]
  N2["12.2 Test procedure"]
  N3["12.3 Comparing"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX045"]

[Learning outcomes]
    |
    v
[12.1 Safe lab]
    |
    v
[12.2 Test procedure]
    |
    v
[12.3 Comparing]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) practise a control test in a safe lab; (2) follow a written test procedure; (3) compare results with expectations.

12.1 Safe lab

In the contained laboratory, Amina practises on a virtual copy of a Fenwick branch: a till computer, an office computer, a firewall and a file server, all running in isolated virtual machines with synthetic data. Nothing connects to Fenwick's real systems. Ms. Bell explains that labs let students try tests and make mistakes without risking business operations or real customer data. Ms. Bell adds that the lab mirrors a real branch closely enough that procedures tested here can be reused at Fenwick.

12.2 Test procedure

Amina follows a written procedure to test the leaver process: create a test user, mark them as a leaver in the lab's HR list, run the reconciliation script and check that the account is flagged and disabled within the agreed time. She records each step and result. The account is flagged but not disabled because the disable step requires manual approval that nobody gave in the lab scenario. The missing approval is a property of the process, not of the script, which is why the next section compares expected and actual results.

12.3 Comparing

The expected result was disablement within one day. The actual result was flagged but still active. Amina notes the gap: the process depends on a person approving, and no reminder exists if approval is forgotten. She recommends an escalation if approval is not given within one day. She learns that labs reveal process gaps, not just technical faults, because they test the whole sequence from start to finish. A one-day escalation would also give the leaver process a measurable target for later checks.

Worked example

Amina tests the leaver process in an isolated lab, finds disablement stalls without approval and recommends escalation.

Synthetic case. The lab environment and data are synthetic.

Errors and limits

Labs differ from production. Scenarios simplify.

Exercises

EX045 — Lab isolation. Why is the lab isolated? Rubric: 3 = to avoid risking real systems and data;; 2 = safety;; 1 = vague;; 0 = none.
EX046 — Lab result. What was the actual result of the leaver test? Rubric: 3 = flagged but not disabled;; 2 = stalled;; 1 = disabled;; 0 = none.
EX047 — Gap cause. Why was the account not disabled? Rubric: 3 = required manual approval was not given;; 2 = approval;; 1 = vague;; 0 = none.
EX048 — Recommendation. What did Amina recommend? Rubric: 3 = escalation if approval not given within one day;; 2 = escalation;; 1 = vague;; 0 = none.

Synthesis

Contained labs test whole processes safely and expose gaps between steps.

Continue studying — chapter 12 of 18

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →