Chapter 29 — Handing over routines | Technologist Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Weekly routine"]
  N2["29.2 Termly routine"]
  N3["29.3 Training"]
  N4["29.4 Documents"]
  N5["Writing routines people can follow"]
  N6["Keeping scripts maintained"]
  N7["Reviewing routines, cover and escalation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Weekly routine"]
  N2["29.2 Termly routine"]
  N3["29.3 Training"]
  N4["29.4 Documents"]
  N5["Writing routines people can follow"]
  N6["Keeping scripts maintained"]
  N7["Reviewing routines, cover and escalation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Weekly routine]
    |
    v
[29.2 Termly routine]
    |
    v
[29.3 Training]
    |
    v
[29.4 Documents]
    |
    v
[Writing routines people can follow]
    |
    v
[Keeping scripts maintained]
    |
    v
[Reviewing routines, cover and escalation]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) write routines; (2) train others; (3) schedule reviews.

29.1 Weekly routine

Dev's weekly routine: run the check scripts, review logs and fix findings.

The weekly routine takes about thirty minutes and covers the stale account, SSH and backup age scripts, the four-item log review and the encryption export. Findings are either fixed that week or recorded as tasks with an owner. The signed checklist is the evidence that the routine happened, which matters when an auditor or the business manager asks. Laptops that have not checked in for two weeks are also listed, since a silent laptop misses updates and baseline changes.

29.2 Termly routine

Restore tests, baseline review and inventory reconciliation.

Each term, Dev restores a sample folder and the management system database to a test machine, reviews the baselines against recent changes and reruns the inventory reconciliation. These tasks take about half a day together and are booked into the school calendar so they are not lost during inspections or exam weeks. The results of all three tasks are filed together with the term's date. Restore times are compared with the previous term's, so a restore that is getting slower is noticed before it matters. The inventory reconciliation also catches donated or replaced laptops that skipped enrolment.

29.3 Training

Tomás trains the business manager to read the summary outputs.

The business manager learns to read each script's summary line, such as late 0 of 6, and to know which results mean asking Dev or the outside company. The business manager does not run the scripts or change systems; the role is to notice when a number moves or a weekly output is missing. This gives the trust a second person who can tell when something is wrong. Training took one short session with the real weekly outputs, followed by the business manager reading the checklist aloud while Dev performed it.

29.4 Documents

Scripts, baselines, change log and routines are stored together.

Keeping the scripts, baselines, change log and routines in one shared folder with version history means a new technician finds everything in one place. Each script has its readme and synthetic test file beside it. Tomás checks that Dev, the business manager and the outside company can all open the folder before he leaves. The change log lives in the same folder, so the documents and the record of changes to them are never separated. Access to the folder is limited to Dev, the business manager and the outside company, because the scripts and notes describe where the servers were weak.

Writing routines people can follow

Each routine is a short checklist with the command or console page for each step, what normal looks like and what to do if something is wrong. Tomás tests the routine by asking the business manager to read it aloud while Dev performs it; any unclear step is rewritten.

The weekly routine takes about thirty minutes. Termly tasks take half a day and are added to the school calendar so they are not forgotten during busy weeks.

Each checklist ends with a line to sign and date, which becomes the record of the routine.

Keeping scripts maintained

Scripts break when exports change format, for example when the management service renames a column after an update. A broken script that prints wrong numbers is worse than one that stops. Each of Tomás's scripts therefore checks that the columns it needs exist and prints a clear error if one is missing. Dev is shown how to update the column names, and the scripts are stored with a short readme listing what each reads and prints. Tomás also includes a small synthetic test file for each script, so after any change Dev can run the test and confirm the output still matches the known answer.

Reviewing routines, cover and escalation

At the end of each term, Dev and the business manager spend twenty minutes checking whether the routines happened and whether any step should change, so the checklists stay useful rather than becoming forgotten documents. When Dev is away, the outside company runs the weekly checks under its contract using the same checklist. Each routine also says when to escalate rather than just record: an unexplained change to an administrator group or a server backup missing for two days goes to the outside company the same day. Clear escalation rules matter most when the usual person is absent and a stand-in must decide what is urgent.

Worked example

Dev completes the routine twice under Tomás's observation.

Synthetic case. The routine is synthetic.

Errors and limits

Routines that rely on one person stop when that person is away.

Exercises

EX085 — Weekly items. List three weekly routine items.
Show marking criteria
Rubric: 3 = three;; 2 = two;; 1 = one;; 0 = none.
EX086 — Termly items. List termly tasks.
Show marking criteria
Rubric: 3 = restore, baseline, inventory;; 2 = two;; 1 = one;; 0 = none.
EX087 — Single person risk. How can the trust reduce dependence on Dev?
Show marking criteria
Rubric: 3 = train another, document;; 2 = document;; 1 = vague;; 0 = none.

Synthesis

Routines keep improvements alive after the placement.

Continue studying — chapter 29 of 30

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →