◇ OpenCyber Academy
Technologist · Chapter 28 · English

Chapter 28 — Field practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Field practice

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 Placement"]
  N2["28.2 Confidentiality"]
  N3["28.3 Tasks"]
  N4["28.4 Journal"]
  N5["28.5 Feedback"]
  N6["28.6 Professional conduct"]
  N7["28.7 Assessment"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 Placement"]
  N2["28.2 Confidentiality"]
  N3["28.3 Tasks"]
  N4["28.4 Journal"]
  N5["28.5 Feedback"]
  N6["28.6 Professional conduct"]
  N7["28.7 Assessment"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 Placement]
    |
    v
[28.2 Confidentiality]
    |
    v
[28.3 Tasks]
    |
    v
[28.4 Journal]
    |
    v
[28.5 Feedback]
    |
    v
[28.6 Professional conduct]
    |
    v
[28.7 Assessment]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) work under supervision in a real CTI environment; (2) apply confidentiality agreements; (3) keep a practice journal; (4) receive and act on feedback.

28.1 Placement

Lena spends six weeks with MCX's coordination desk under a confidentiality agreement. She sees how members' submissions are checked, labelled and redistributed.

The coordination desk sits at the centre of the exchange that CMS normally sees only from the outside. Lena sees how submissions arrive in different formats, how labels are checked and how items are redistributed to members. The confidentiality agreement covers everything she sees from other councils, which she would not normally have access to. Six weeks gives time to see both routine days and at least one surge, such as the fraud wave Lena later observes.

28.2 Confidentiality

Everything seen on placement stays there unless released. Her coursework uses synthetic examples inspired by patterns, never real member details.

Patterns can be used in coursework because they are general lessons, such as how a fraud wave produces many duplicate submissions. Details of a member's incident cannot, because they were shared with MCX on terms that do not include Lena's polytechnic. Synthetic examples keep the lesson while leaving the data where it belongs. Lena checks each piece of coursework against this rule before submitting it, removing anything traceable to a member.

28.3 Tasks

Normalising submissions, checking labels, drafting summaries for review, answering members' format questions. She does not approve releases.

Each task uses skills from the course: normalising follows the rules of chapter 12, label checks follow TLP 2.0, and summaries follow the three-line note. Answering members' format questions teaches her how other councils send data, which helps CMS later. Approving releases is left to the coordinators, because a release decision affects every member. Each task is supervised, and Lena's drafts go to her mentor before any member sees them. Answers to format questions follow the desk's published guidance, so members receive the same answer whoever replies.

28.4 Journal

Daily notes: what I did, what I learned, what I would ask. Notes contain no restricted details; they record lessons, not data.

The third question, what I would ask, keeps open questions from being forgotten and gives the mentor topics for review. Recording lessons rather than data means the journal can be shown to her polytechnic tutor without breaching the confidentiality agreement. An entry might note how labels were checked without naming the member or item. Lena reviews the week's notes each Friday and turns repeated lessons into short points for her CMS work.

28.5 Feedback

Her mentor reviews every draft. Early feedback: "Your summaries bury the action at the end." Lena moves actions to the first line.

Reviewing every draft is possible because Lena's drafts are short summaries. The feedback about burying the action matches the three-line note she already uses at CMS, where the action has its own line. Moving the action to the first line reflects the desk's readers, members who scan many summaries and need to know at once whether to act.

28.6 Professional conduct

Arrive prepared, ask questions, admit mistakes immediately. A wrong label caught early is a lesson; one hidden is a breach.

A wrong label on a shared item can reach every member before anyone notices, so admitting it at once lets the desk correct it before it spreads further. Hiding it turns a handling mistake into a breach of the trust members place in the desk. Lena's own flag of a mislabelled submission, in the worked example, shows the expected behaviour.

28.7 Assessment

The placement supervisor rates reliability, handling discipline, communication and learning; the journal shows reflection.

Handling discipline is rated separately because a placement at a sharing desk tests it constantly: every item carries a label that decides who may see it. The journal shows what Lena learned and how she reasoned, which the supervisor's ratings alone would not reveal. Both the ratings and the journal count towards her placement assessment. The supervisor bases each rating on observed work, such as the mislabelled submission she flagged, so the ratings can be explained. Lena reads the assessment with her mentor and adds the points raised to her journal as goals for the next stage.

28.8 After placement

Contacts made are professional; requests to them go through proper channels, not personal favours for restricted data.

A contact at MCX might be able to answer a question informally, but if the answer involves restricted data, the proper route is a request through CMS's membership. Using personal favours would bypass the controls members rely on. Keeping contacts professional also protects the colleague, who could breach their own rules by helping. Lena records her placement contacts in her notes with their roles, so later requests go to the right desk through CMS.

Learning from the desk

Lena observes how the desk handles a surge: twenty submissions on one fraud wave in an hour. The coordinator merges them into one item, credits each member and publishes once. Watching triage under pressure teaches more than any slide; Lena notes the merge procedure and later proposes a similar approach for CMS's own service-desk reports during campaigns.

Worked example

Lena notices a member submission labelled TLP:CLEAR containing a staff email address. She flags it to her mentor rather than editing it herself. The mentor contacts the member, who confirms the address should be removed; the corrected version is released.

Synthetic case. The submission is invented.

Errors and limits

Placements show one organisation's habits; compare them with standards.

Exercises

Synthesis

Work within supervision and confidentiality, journal lessons not data, welcome feedback and act professionally.

Continue studying — chapter 28 of 30

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →