Chapter 28 — Field practice | Technologist Security architecture and engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Field practice

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 A second site"]
  N2["28.2 Adapting"]
  N3["28.3 Reflection"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 A second site"]
  N2["28.2 Adapting"]
  N3["28.3 Reflection"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 A second site]
    |
    v
[28.2 Adapting]
    |
    v
[28.3 Reflection]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) apply skills at a second organisation; (2) adapt to a different environment; (3) reflect on transferable practice.

28.1 A second site

For field practice Tomás spends two weeks with a fictional community sports centre that runs a booking website, card payments through a provider, door access cards and a small office network. Its manager handles IT alongside everything else. Tomás repeats his method: inventory, data flows, exposure points and quick wins. The environment is simpler than Brightwater's but has fewer people to run anything. He starts by asking the manager which outage would hurt most, which is the booking website on a Saturday morning.

28.2 Adapting

Tomás finds that the booking website's administrator account is shared by four staff, the office router still uses its default password and door access cards are never cancelled when members leave. He fixes the router password with the manager, sets up individual administrator accounts with multi-factor sign-in and writes a one-line step into the membership cancellation procedure to deactivate cards. He skips complex measures such as central logging. Adapting means choosing the few changes that matter most for this organisation's capacity.

28.3 Reflection

In his log, Tomás notes what transferred: inventories, individual accounts, leaver processes and checking exposure. What did not: monitoring routines and automation, which assume someone with time. He reflects that the architecture principles stay the same, but the implementation must fit the people available. The manager emails a month later to say the cancellation step has deactivated eleven cards. Ruth comments that this practical result is better evidence of learning than any written test. He adds these observations to his placement report for Ruth and Sam to read.

Worked example

Tomás applies his method at a sports centre, fixes three priority issues suited to its capacity and reflects on what transfers.

Synthetic case. The sports centre is synthetic.

Errors and limits

Short placements leave changes unsupported. Small sites may revert under pressure.

Exercises

EX082 — Most painful outage. Which outage would hurt the sports centre most? Rubric: 3 = the booking website on a Saturday morning;; 2 = booking;; 1 = door cards;; 0 = none.
EX083 — Card fix. How were leavers' door cards handled? Rubric: 3 = a deactivation step added to membership cancellation;; 2 = procedure;; 1 = vague;; 0 = none.
EX084 — Evidence of learning. What result did the manager report a month later? Rubric: 3 = eleven cards deactivated;; 2 = eleven;; 1 = vague;; 0 = none.

Synthesis

Field practice shows that principles transfer while implementation must fit the people available.

Continue studying — chapter 28 of 30

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →