◇ OpenCyber Academy
Technologist · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Threats to councils"]
  N2["5.2 The cycle in a small team"]
  N3["5.3 TLP 2.0"]
  N4["5.4 Information versus intelligence"]
  N5["5.5 Who acts"]
  N6["5.6 Proportion"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Threats to councils"]
  N2["5.2 The cycle in a small team"]
  N3["5.3 TLP 2.0"]
  N4["5.4 Information versus intelligence"]
  N5["5.5 Who acts"]
  N6["5.6 Proportion"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Threats to councils]
    |
    v
[5.2 The cycle in a small team]
    |
    v
[5.3 TLP 2.0]
    |
    v
[5.4 Information versus intelligence]
    |
    v
[5.5 Who acts]
    |
    v
[5.6 Proportion]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) describe common threats to local government; (2) explain the CTI cycle in a small team; (3) use TLP 2.0 labels correctly; (4) separate information from intelligence.

5.1 Threats to councils

Local governments face payment fraud through lookalike portals, ransomware that disrupts services (Data Encrypted for Impact, T1486), credential phishing against staff, and defacement of public websites. Residents' trust makes even minor incidents newsworthy.

Each threat maps to part of the estate described in chapter 1. Lookalike portals copy the permits and payments services, ransomware would hit file servers and backups, phishing reaches staff email and the directory, and defacement targets the public website. Lena uses that mapping to decide which owner should receive each kind of intelligence.

5.2 The cycle in a small team

Direction from the security manager, collection from MCX and public advisories, processing in Lena's scripts, analysis with her supervisor, dissemination to owners and feedback at a weekly meeting. In a team of three, the cycle is informal but each stage still happens.

In practice, the security manager says what to watch, Lena gathers MCX items and public advisories, her scripts deduplicate and classify, and she and her supervisor judge relevance. Owners then receive what they need, and the weekly meeting reviews what was useful. Each stage can be done in minutes, but skipping one usually shows up as noise or a missed item.

5.3 TLP 2.0

TLP:CLEAR — no limit. TLP:GREEN — the community, not public. TLP:AMBER — the organisation and its clients, need to know. TLP:AMBER+STRICT — the organisation only. TLP:RED — named recipients only. FIRST's definitions are short; Lena keeps a copy beside her desk.

The difference between AMBER and AMBER+STRICT matters at CMS, because AMBER allows sharing with clients on a need-to-know basis while AMBER+STRICT keeps an item within the organisation. Lena checks the label before forwarding anything outside the security team, and the worked example shows what she does when a wider audience is needed.

5.4 Information versus intelligence

A list of fraud domains is information. A note saying "residents are being targeted with fake permit-payment sites this month; we have asked the hosting provider to take two down and posted a warning on the council site" is intelligence: assessed and tied to action.

The second statement adds what the first lacks: who is targeted, what CMS has done and what readers should know. A list of domains leaves every reader to work that out alone. Lena's job is to make the step from list to assessment once, so owners receive something they can act on immediately.

5.5 Who acts

Lena informs; owners act. The web team posts warnings; the network team blocks; the communications team speaks to residents.

Keeping action with owners means each team decides in its own area: the web team knows how to word a warning on the site, the network team knows what a block will affect, and communications knows how residents will read a message. Lena's notes name the owner and the suggested action, so nobody has to guess who should move. When an owner decides not to act, Lena records the decision so the weekly meeting can revisit it.

5.6 Proportion

Not every advisory is urgent. Lena labels each item as act now, act this week, or note only, so owners can plan.

The three labels map directly onto how owners plan their work. Act now goes to the right owner immediately, such as a block for a domain already in resolver logs; act this week fits a normal patch or change cycle; and note only is filed for reference. The worked example in chapter 1 shows an internal document system routed to the normal patch cycle rather than labelled act now.

Worked example

An MCX item marked TLP:AMBER describes fraud domains targeting a neighbouring city. Lena may share it with CMS staff who need it, but not post it publicly. The communications team asks for a public warning; Lena asks MCX for a CLEAR version, which arrives the next day.

Synthetic case. The item is invented.

Errors and limits

TLP labels only work if everyone knows them; brief new staff.

Exercises

Synthesis

Know the threats, run the cycle even in a small team, apply TLP precisely and turn information into actionable intelligence.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →