◇ OpenCyber Academy
Technical · Chapter 5 · English

Chapter 5 — Security scope and evidence

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security scope and evidence

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Scope"]
  N2["5.2 TLP 2.0"]
  N3["5.3 Evidence and provenance"]
  N4["5.4 Personal data"]
  N5["5.5 Authorisation"]
  N6["5.6 Public sources"]
  N7["5.7 Mistakes"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Scope"]
  N2["5.2 TLP 2.0"]
  N3["5.3 Evidence and provenance"]
  N4["5.4 Personal data"]
  N5["5.5 Authorisation"]
  N6["5.6 Public sources"]
  N7["5.7 Mistakes"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 Scope]
    |
    v
[5.2 TLP 2.0]
    |
    v
[5.3 Evidence and provenance]
    |
    v
[5.4 Personal data]
    |
    v
[5.5 Authorisation]
    |
    v
[5.6 Public sources]
    |
    v
[5.7 Mistakes]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) define the scope of CTI support work; (2) apply TLP 2.0 to everyday handling; (3) keep evidence with provenance; (4) avoid actions outside authorisation.

5.1 Scope

Tomás may: read intelligence from ESX and approved public sources, match indicators against college logs, draft notes and requests, and maintain the indicator list. He may not: block on production systems himself, contact attackers, visit suspicious sites from college devices, or share restricted material.

The line between these lists is drawn by who carries the risk of each action. Matching and drafting change nothing on college systems, while blocking and contact can disrupt services or alert attackers. When an action falls outside the list, Tomás writes a request to the owning team and waits for their decision.

5.2 TLP 2.0

CLEAR — public. GREEN — community, not public. AMBER — Ashgrove and its clients on a need-to-know basis. AMBER+STRICT — Ashgrove only. RED — named people only. Unlabelled material is treated as AMBER until the sender confirms.

Tomás reads the label before forwarding anything, because the label limits who may receive it. In the vendor case, an unlabelled report was treated as AMBER until the vendor confirmed AMBER+STRICT, which kept it inside Ashgrove. ESX items marked GREEN may go to other member colleges, but never to a public page or social media.

5.3 Evidence and provenance

Every item records source, date received, TLP, what the source based it on, and Tomás's checks. Exported log extracts used as evidence are saved with the ticket.

When Tomás later explains a block or a match, the provenance record shows exactly which report it came from and what was checked. A note that says only 'from ESX' cannot be tested by anyone else. Log extracts saved with the ticket let a reviewer repeat his match without searching the live logs again.

5.4 Personal data

Logs include student and staff identities. Extracts contain only what the question needs; names are removed before sharing with ESX.

When Tomás shares a finding with ESX, such as the lookalike invoice domain, he includes the sender domain and dates but not the name of the staff member who received it. Inside Ashgrove, extracts keep usernames only when the receiving team must act on a specific account. Every other field is left out of the extract at export time. Removing names before sharing does not weaken the indicator, because other colleges need the domain and dates, not the recipient.

5.5 Authorisation

The placement agreement and IT security policy define what Tomás may do. When unsure, he asks his supervisor and records the answer.

The placement agreement names his supervisor as the person who decides unclear cases. Recording each answer means the same question does not need asking twice, and it protects Tomás if his action is later questioned. Several of those recorded answers have since become rules on the team's one-page safety sheet. The supervisor's answers are kept in a shared note that later placement students can read before asking the same question.

5.6 Public sources

Government advisories and vendor blogs are useful, but their terms vary. Quoting short parts with attribution is usually fine; republishing whole reports is not.

Tomás records the terms of each public source he uses, alongside its grade in the platform. A government advisory may allow free reuse, while a vendor blog may forbid copying beyond short quotations. When unsure, he summarises the source in his own words, attributes it and links to the original instead of copying text. The source terms are noted in the platform record, so they travel with each item.

5.7 Mistakes

If he shares something wrongly, he reports it at once so the recipient can delete it. Hiding mistakes breaks trust far more.

A wrong share caught quickly can be contained: the recipient deletes the material and the error is logged. Tomás tells his supervisor first, then the recipient, and records the event in the failure log for review. The review asks why the error happened, which is how process problems such as missing labels come to light. Tomás's own early mistakes are in that log too, which shows newer students that reporting is expected.

Checklists

A short pre-share checklist — label checked, personal data removed, recipient allowed — takes a minute and prevents most handling errors.

Worked example

A vendor email contains an unlabelled report naming other colleges. Tomás treats it as AMBER, asks the vendor for its intended label, and in the meantime shares only a summary with the Ashgrove email team. The vendor replies "AMBER+STRICT", so the summary stays inside Ashgrove.

Synthetic case. The report is invented.

Errors and limits

Policies cannot foresee every case; asking is part of the job.

Exercises

Synthesis

Know your scope, apply TLP strictly, record provenance, minimise personal data and ask when unsure.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →