Chapter 14 — Security governance, risk and compliance: automation
Lesson map
Lesson 14 published. Map, example, EX053.
flowchart TD
N0["Learning outcomes"]
N1["14.1 Choosing what to automate"]
N2["14.2 Warning levels"]
N3["Lab — Certificate expiry warnings and alerts"]
N4["14.3 Reaching owners"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX053"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 Choosing what to automate"]
N2["14.2 Warning levels"]
N3["Lab — Certificate expiry warnings and alerts"]
N4["14.3 Reaching owners"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX053"]
[Learning outcomes]
|
v
[14.1 Choosing what to automate]
|
v
[14.2 Warning levels]
|
v
[Lab — Certificate expiry warnings and alerts]
|
v
[14.3 Reaching owners]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX053]
Learning outcomes
You will (1) automate a recurring check; (2) set warning and alert levels; (3) ensure automated results reach owners.
14.1 Choosing what to automate
Amina looks for recurring checks that are easy to automate and costly to forget. Certificate expiry is a good candidate: an expired certificate can stop the online shop or remote access, and checking dates manually is tedious. She writes a script that reads a list of certificates and their expiry dates and reports how many days remain. She learns that automation is best for simple, repetitive checks with clear rules. A certificate list with expiry dates is a simple input with a clear rule, which makes it a safer first automation than complex log analysis.
14.2 Warning levels
The script warns when thirty days or fewer remain and alerts when a certificate has expired. On the first of October, the lab finds the remote access certificate expired three days earlier, the shop certificate due in nineteen days with a warning, and two others fine at forty-five and one hundred and fifty-one days. The expired certificate explains complaints from staff who could not connect from home over the weekend. Had the script been running a month earlier, the remote access certificate would have triggered a warning about thirty days before it expired.
Lab — Certificate expiry warnings and alerts
"""Certificate expiry check: warn within 30 days, alert if expired (synthetic)."""
from datetime import date
today = date(2026, 10, 1)
certs = {"shop.fenwick.example": date(2026, 10, 20), "mail.fenwick.example": date(2027, 3, 1),
"vpn.fenwick.example": date(2026, 9, 28), "pos-api.fenwick.example": date(2026, 11, 15)}
for n, d in sorted(certs.items(), key=lambda x: x[1]):
left = (d - today).days
s = "EXPIRED" if left < 0 else "WARN" if left <= 30 else "ok"
print(f"{n}: {left} days {s}")
Run with python3 lab_certs.py. Verified output:
vpn.fenwick.example: -3 days EXPIRED
shop.fenwick.example: 19 days WARN
pos-api.fenwick.example: 45 days ok
mail.fenwick.example: 151 days ok
14.3 Reaching owners
An automated check is useless if nobody reads it. Amina sets the script to run daily and send results to the IT lead and the ticketing system, creating a ticket for any warning or alert. The expired certificate is renewed the same day and the shop certificate within a week. She learns that automation must include delivery to owners and a follow-up path, or it becomes another ignored report. Creating a ticket for each warning gives every result an owner and a closure record.
Worked example
Amina automates certificate expiry checks, finds one expired and one in warning and routes results to tickets.
Synthetic case. Certificates and dates are synthetic.
Errors and limits
Lists can omit certificates. Tickets can be ignored.
Exercises
- EX053 — Automation candidate. Why is certificate expiry a good automation candidate? Rubric: 3 = simple, repetitive and costly to forget;; 2 = fit;; 1 = vague;; 0 = none.
- EX054 — Expired certificate. Which certificate had expired? Rubric: 3 = vpn.fenwick.example, 3 days earlier;; 2 = VPN;; 1 = shop;; 0 = none.
- EX055 — Warning certificate. Which certificate was in warning? Rubric: 3 = shop, 19 days left;; 2 = shop;; 1 = mail;; 0 = none.
- EX056 — Delivery path. How do results reach owners? Rubric: 3 = daily email to IT lead and tickets for warnings and alerts;; 2 = tickets;; 1 = vague;; 0 = none.
Synthesis
Automation works when checks are simple and results reach owners with a follow-up path.
Continue studying — chapter 14 of 18
← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →