Chapter 5 — Security scope and evidence

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Scope"]
  N2["5.2 Evidence"]
  N3["Synthesis"]
  N0 --> N1 --> N2 --> N3
  N3 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Scope"]
  N2["5.2 Evidence"]
  N3["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Scope]
    |
    v
[5.2 Evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of a security task; (2) collect evidence properly; (3) respect authorisation limits.

5.1 Scope

Before any technical security work, Amina learns to agree scope in writing: which systems, which activities and which times are allowed. For her placement at Fenwick, the scope allows reading configuration exports, reviewing logs and checking firewall rules, but not testing for vulnerabilities on live systems. Ms. Bell stresses that working outside scope, even with good intentions, can breach rules or laws and damage trust. Her written scope also lets her answer quickly when someone at Fenwick asks her to test something not on the list.

5.2 Evidence

Amina learns how to collect evidence: record what was checked, when, by whom and how, and keep the original output such as an export file or screenshot. She names files consistently and stores them in a folder where they cannot be changed after collection. She learns that evidence must allow someone else to see exactly what she saw, which matters for audits and for fixing problems later. An export kept unchanged in a read-only folder can be compared later with a fresh export to see what changed.

5.3 Authorisation limits

During her work, Amina notices a server that appears to allow remote desktop from the internet. Testing it would be outside her scope. She reports it to the IT lead with the evidence she already has: the firewall rule showing the connection. The IT lead investigates and closes it. She learns that the correct response to something outside scope is to report it, not to investigate it herself without permission. The firewall rule she already had in hand was enough evidence for the IT lead to act without her probing the server.

Worked example

Amina works under a written scope, collects traceable evidence and reports an out-of-scope concern instead of testing it.

Synthetic case. Scope and findings are synthetic.

Errors and limits

Scopes can be unclear. Evidence folders need access control.

Exercises

• EX017 — Excluded activity. Which activity was outside Amina's scope? Rubric: 3 = vulnerability testing of live systems;; 2 = testing;; 1 = vague;; 0 = none.
• EX018 — Evidence record. What should an evidence record include? Rubric: 3 = what, when, who, how and original output;; 2 = record;; 1 = vague;; 0 = none.
• EX019 — Out-of-scope response. What should you do on spotting something outside scope? Rubric: 3 = report it with existing evidence;; 2 = report;; 1 = test it;; 0 = none.
• EX020 — Unchangeable storage. Why store evidence where it cannot be changed? Rubric: 3 = so others can trust it shows exactly what was seen;; 2 = integrity;; 1 = vague;; 0 = none.

Synthesis

Written scope, careful evidence and respect for limits make technical security work trustworthy.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →