Chapter 22 — Security architecture and engineering: automation
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Choosing a task"]
N2["Lab — Comparing accounts with the leaver list"]
N3["22.2 Safe automation"]
N4["22.3 Time saved"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Choosing a task"]
N2["Lab — Comparing accounts with the leaver list"]
N3["22.2 Safe automation"]
N4["22.3 Time saved"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Choosing a task]
|
v
[Lab — Comparing accounts with the leaver list]
|
v
[22.2 Safe automation]
|
v
[22.3 Time saved]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) automate a repetitive security task; (2) make automation safe and reviewable; (3) measure time saved.
22.1 Choosing a task
Tomás looks for repetitive work. Every month Sam manually compares the account list with human resources' leaver list to find accounts not disabled. It takes two hours and errors creep in. Tomás automates it: a script compares the two exports and lists accounts belonging to leavers that are still active. Good candidates for automation are frequent, rule-based and error-prone when done by hand. Tasks needing judgement stay with people, with automation preparing the information. He also confirms both exports use the same username format before writing any code, since mismatched names would produce false results.
Lab — Comparing accounts with the leaver list
# Compare active accounts with the HR leaver list (synthetic exports).
active = {"a.silva", "j.mensah", "t.ferreira", "p.kowal", "s.okafor", "l.chen"}
leavers = {"j.mensah", "p.kowal", "r.dubois"}
still_active = sorted(active & leavers)
print(f"leavers still active: {still_active}")
print(f"leavers already disabled: {sorted(leavers - active)}")
Run with python3 lab_leavers.py. Verified output:
leavers still active: ['j.mensah', 'p.kowal']
leavers already disabled: ['r.dubois']
22.2 Safe automation
The script only reports; it does not disable accounts. Sam reviews the list and disables accounts himself, because some former staff have approved short extensions for handover. Tomás stores the script in the company's code repository, adds tests using synthetic data, and records the expected input format. If human resources changes its export, the script fails loudly rather than producing an empty, misleading list. Automation that acts without review can cause outages; automation that reports with checks saves time safely.
22.3 Time saved
The lab finds two active accounts belonging to leavers, matching Sam's last manual check plus one he missed. Running the script takes seconds; reviewing the output takes ten minutes. Tomás estimates savings of nearly two hours a month and fewer missed accounts. He records the estimate in the placement log. Ruth points out that the main gain is not time but reliability: the check now happens every month even when Sam is on holiday, because anyone can run it. Sam adds the script to the monthly operating calendar.
Worked example
Tomás automates a monthly leaver check as a report-only script with tests and loud failure, finding two active leaver accounts.
Synthetic case. Accounts and lists are synthetic.
Errors and limits
Name mismatches between systems cause false results. Report-only scripts still need someone to act.
Exercises
- EX064 — Automation candidates. What makes a task a good automation candidate? Rubric: 3 = frequent, rule-based and error-prone by hand;; 2 = two;; 1 = judgement tasks;; 0 = none.
- EX065 — Report only. Why does the script only report? Rubric: 3 = some leavers have approved extensions needing judgement;; 2 = judgement;; 1 = speed;; 0 = none.
- EX066 — Lab result. Which leaver accounts were still active in the lab? Rubric: 3 = j.mensah and p.kowal;; 2 = two;; 1 = vague;; 0 = none.
Synthesis
Safe automation reports clearly, fails loudly and leaves judgement to people, improving reliability more than speed.
Continue studying — chapter 22 of 30
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →