Chapter 20 — Security governance, risk and compliance: troubleshooting

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 A failing control"]
  N2["20.2 Diagnosis"]
  N3["20.3 Fixing"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 A failing control"]
  N2["20.2 Diagnosis"]
  N3["20.3 Fixing"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 A failing control]
    |
    v
[20.2 Diagnosis]
    |
    v
[20.3 Fixing]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) investigate why a control is not working; (2) separate design, operation and evidence problems; (3) fix the right thing.

20.1 A failing control

Screen locks fail tests in several clinics despite policy and central settings. Priya investigates. She checks the device management configuration, visits two clinics and talks to receptionists. She learns to separate three kinds of problems: design, where the control itself is unsuitable; operation, where it is suitable but not performed; and evidence, where it works but proof is missing. Each needs a different fix, so diagnosis comes before action. Visiting two clinics, rather than reading reports only, is what lets her distinguish these three kinds of problem.

20.2 Diagnosis

Priya finds that the central setting was correct, but receptionists had found a way to keep screens awake using a media player during busy periods, because unlocking repeatedly slowed patient check-in. The design did not fit the work. In another clinic, locks worked but the test recorded failure because the tester checked an unmanaged spare computer. That was an evidence problem. She learns that one symptom can hide different causes in different places. The media player workaround is a design problem, while the unmanaged spare computer is an evidence problem.

20.3 Fixing

For the design problem, Priya proposes badge unlocking that takes a second. For the evidence problem, she updates test instructions to check only managed reception computers and to record the spare as a separate asset. She avoids recommending disciplinary action against receptionists, since the workaround revealed a usability issue. She learns that troubleshooting governance controls resembles troubleshooting technology: test hypotheses, gather evidence and fix the actual cause. Recording the spare computer as a separate asset also brings it into the inventory, where it can be managed or retired.

Worked example

Priya separates design, operation and evidence problems, finds a usability workaround and a test error and fixes each appropriately.

Synthetic case. The investigation is synthetic.

Errors and limits

Workarounds can hide malicious use. Badge systems need support.

Exercises

• EX058 — Problem types. What three types of control problem did Priya separate?
  Show marking criteria

  Rubric: 3 = design, operation and evidence;; 2 = three;; 1 = vague;; 0 = none.
• EX059 — Workaround cause. Why did receptionists keep screens awake?
  Show marking criteria

  Rubric: 3 = unlocking repeatedly slowed patient check-in;; 2 = usability;; 1 = laziness;; 0 = none.
• EX060 — Evidence error. What evidence problem did Priya find?
  Show marking criteria

  Rubric: 3 = tester checked an unmanaged spare computer;; 2 = test scope;; 1 = vague;; 0 = none.

Synthesis

Troubleshooting controls means diagnosing design, operation and evidence problems separately.

Continue studying — chapter 20 of 30

← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →