◇ OpenCyber Academy
Technologist · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Security goals at a school"]
  N2["5.2 Assets and threats"]
  N3["5.3 Risk and priority"]
  N4["5.4 Types of control"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Security goals at a school"]
  N2["5.2 Assets and threats"]
  N3["5.3 Risk and priority"]
  N4["5.4 Types of control"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Security goals at a school]
    |
    v
[5.2 Assets and threats]
    |
    v
[5.3 Risk and priority]
    |
    v
[5.4 Types of control]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain core security goals; (2) identify assets, threats and risks at a school; (3) describe control types.

5.1 Security goals at a school

Confidentiality, integrity and availability apply to the school as to any organisation. Student records and finance data must stay confidential. Exam marks and attendance records must not be altered improperly. The learning platform and internet access must be available during lessons. Tomás notices that availability is especially visible at a school: if the network fails during an exam or a lesson, hundreds of people are affected at once, so any security change must be planned carefully to avoid disrupting teaching.

5.2 Assets and threats

Tomás lists the school's key assets: student records, finance systems, staff email, the learning platform, the network itself and the school's reputation. He then lists threats: a student trying to reach staff systems out of curiosity, malware arriving on a personal device, a phishing email stealing a staff password, an outdated switch being misused, and accidental damage from a misconfiguration. Threats at a school include curious students, which is less common in businesses, and controls must assume some users will test boundaries.

5.3 Risk and priority

Risk combines likelihood and impact. A student reaching the finance office printer is likely given the flat network, but the impact is modest. A student reaching the student records system is less likely but would have serious impact. Tomás ranks risks on a simple high, medium and low scale and discusses the ranking with Gareth. They agree that separating administrative systems from the student network is the top priority, followed by securing switch management and reviewing unapproved services. The agreed ranking is recorded with its date.

5.4 Types of control

Controls are preventive, detective or corrective. Network separation prevents students reaching admin systems. Logging and alerts detect unusual activity. Backups correct the effects of data loss. Tomás also distinguishes technical controls, like firewalls, from administrative ones, like an acceptable use policy that students sign. Good security combines both: a policy tells students what is not allowed, and technical controls make it difficult to break the policy, while logs show when someone tries. No single control type is sufficient on its own.

Worked example

Tomás's risk list ranks student access to admin systems as the top risk, followed by insecure switch management.

Synthetic case. Risks are synthetic.

Errors and limits

Ignoring curious insiders such as students underestimates threats in school networks.

Exercises

Synthesis

Goals, assets, threats and risks guide which controls a school should apply first.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →