A phone call from the head's office
The phone rings at the help desk. "This is the head's office. I need the staff list now. It is urgent. Send it to my home email."
You are new. The voice is calm and sure. Do you send it? A good technician pauses, checks, and then decides.
Key words
| Word | What it means |
|---|---|
| Security request | A request that affects security, such as new access, a password reset or a change to a control. |
| Requestor | The person or body who makes the request. |
| Origin | Where a request really came from. |
| Verify | Check that something is true, by a trusted second route. |
| Permission | What a person is allowed to do. |
| Sensitive | Likely to cause harm if it is exposed. |
| Personal data | Facts about a real person who can be named from them. |
| Firewall | A control that allows or blocks traffic by rule. |
| Escalate | Pass a decision up to somebody with more authority. |
| Social engineering | Tricking a person into breaking security rules. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can judge a security request by its origin, reason, requestor, sensitivity and new risks, and decide to approve, refuse or escalate it.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Check 1 and 2: origin and reason
Judge every request in five ways. Start with the first two.
Origin: where did it really come from? A phone call, an email and a visit can all be faked. Verify through a second route you trust, such as calling back a number from the staff directory.
Reason: is there a clear, believable reason? "It is urgent" is not a reason.
Checks 3 and 4: who and how sensitive
Status and permissions of the requestor: who are they? A member of staff, an outside partner or a stranger? What are they permitted to ask for?
Sensitivity: how much harm if it goes wrong? A request that would expose personal data is sensitive. It needs the most care.
Check 5: new risks, and the rules
New risks: would saying yes add a risk? For example, opening a door in the firewall, or giving more power than the person needs.
Finally, handle the request in line with the rules. That means data protection law and the company's own policies. Write down what you decided and why.
Check: the five checks
Have a go
Check: the five checks
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.