◇ OpenCyber Academy
Technologist · Chapter 1 · English

Chapter 1 — Computing systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 1 — Computing systems

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The course and the case"]
  N2["1.2 Kinds of systems"]
  N3["1.3 Starting an inventory"]
  N4["1.4 Why systems matter for privacy"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The course and the case"]
  N2["1.2 Kinds of systems"]
  N3["1.3 Starting an inventory"]
  N4["1.4 Why systems matter for privacy"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 The course and the case]
    |
    v
[1.2 Kinds of systems]
    |
    v
[1.3 Starting an inventory]
    |
    v
[1.4 Why systems matter for privacy]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) describe the systems that handle member data in a fitness business; (2) distinguish servers, cloud services, apps and devices; (3) start a system inventory.

1.1 The course and the case

Aisha Bello begins a three-year technologist course at the fictional Lindon Technical Institute, supervised by Mr. Tom Reilly. Her work placement is with the fictional Quayside Fitness, a chain of forty gyms with about 60,000 members, a mobile app and wearable heart-rate straps used in classes. Quayside holds names, contact details, payment data, workout histories, heart-rate readings and CCTV footage. Mr. Reilly explains that privacy and data protection will be her specialism, and that each technical course will be applied to Quayside's systems.

1.2 Kinds of systems

Aisha lists Quayside's systems. A membership system in the cloud stores contracts and payments. The app stores profiles and workout history. Club computers run door access and class booking. Wearable straps send heart-rate data to class screens and to the app. CCTV recorders sit in each club. She notes that some systems are run by Quayside and some by vendors, and that member data move between them. Understanding the kinds of systems helps her see where data are stored and who controls them.

1.3 Starting an inventory

Mr. Reilly asks Aisha to start an inventory. For each system she records its purpose, the data it holds, where it runs, who owns it and which vendor supports it. The inventory reveals that nobody owns the CCTV recorders centrally; each club manager manages their own. She notes this as a governance gap. She learns that Article 30 of the GDPR requires a record of processing activities, and that her technical inventory will feed that record. The record must list purposes, categories of data and recipients, so her columns use the same headings.

1.4 Why systems matter for privacy

Aisha reflects that privacy depends on systems behaving correctly. A policy may say heart-rate data are deleted after a year, but if the app keeps them forever, the policy is false. She concludes that technologists have a key role: they know how systems actually behave and can check that practice matches policy. Mr. Reilly agrees and adds that technologists often discover privacy problems first, because they see the data every day. Her first example is the app's export button, which the written policy never mentions but which lets any manager download every member in seconds.

Worked example

Aisha lists Quayside's membership, app, club, wearable and CCTV systems, starts an inventory that reveals no central CCTV owner and links it to Article 30.

Synthetic case. Lindon, Quayside and all people are synthetic; GDPR Article 30 is real.

Errors and limits

A first inventory is incomplete; plan to revisit it.

Exercises

Continue studying — lesson 01 (chapter 01 of 30)

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.