Page 196 - CyberSecurityEssentialsEnglish

7. How do you turn a long output into checkable claims?
8. What is the difference between a primary source and independent coverage?
9. Explain the steps of SIFT and of lateral reading.

10. How can bias appear in measurement or in use rather than only in the data?
11. Why is provenance data not a judgment about the truthfulness of content?

12. What is the minimum information a record of AI use should contain?
13. When should you stop and escalate a task to an expert?
14. What is the correct order of incident response, and why does containment precede the

search for who is responsible?

Practical Exercises

↻ Exercise 1: Classifying risk before using a tool
Goal: Turn a general sense of danger into a decision you can justify.
Required: Five tasks from your work or study. Allow about 40 minutes.

Steps: Write for each task its description, the data it needs, and the impact of an error.
Then classify it across the six dimensions of probability, severity, scope, detectability,
reversibility, and autonomy. Then set the level of review or prohibition.
Output: A table of five tasks with a clear decision on use.
Assessment criterion: A classification based on the name of the task alone, without its
context, its data, and its permissions, is not accepted.

↻ Exercise 2: Building a safe data copy
Goal: Apply data minimization in practice before anything is uploaded.
Required: A fictitious or public file. Allow about 35 minutes.
Steps: Delete the direct identifiers. Group rare values into categories. Replace names
with codes and keep the key separately. Then inspect the file properties, the hidden
notes, and the revision history.
Output: A list of the fields deleted or replaced, with the reason for each change.

Assessment criterion: The copy still supports the task after minimization. Removing the
name alone is not anonymization.
Warning: Do not use real data about people, customers, or students in this exercise.

↻ Exercise 3: Testing safe delegation
Goal: Separate the thinking a system may do from the actions it may take.

Required: A task that begins with a draft and ends with a possible external action, such as
an email or a record update. Allow about 40 minutes.
Steps: Define the degree of delegation. State the permissions required. Fix the approval
point. State exactly what the reviewer sees before execution. Then define how the action
can be stopped and by whom.
Output: A delegation ladder with at least four levels.
Assessment criterion: Refusing or editing the action is easier than approving it without
reading.

195