Project 403 final report

This is the final report for project 403, "Consider User Security Training Materials". See also the project definition, the project home page, and the Learn course entitled "Informatics Server Basics".

Timescale, main work periods

Although proposed some time earlier, the project officially started in November 2019 and in total took about 235 hours (6 to 7 weeks). These were the main periods of work on it:

January and February 2020 (37 hours)

The main emphasis of the project very quickly became self-managed servers. Indeed, this had been envisaged as the aim of the project before it had been proposed.

In January I researched and wrote an extensive list of ideas for the project, which I circulated among computing staff to encourage discussion and get more ideas. This was successful, producing a large list of the responsibilities of managers of self-managed machines, a list of the likely threats (which, disappointingly in the light of subsequent events, did not include the risk of the machine being used as a gateway by attackers for purposes such as sending spam), and a list of security-related obligations.

April and May 2020 (68 hours)

In this period more ideas, responses and data were gathered, and I started the process of writing up the material as the first draft of a self-enrol course.

November 2020 to January 2021 (47 hours)

This period saw the completion of the first draft of a course.

April and May 2021 (69 hours)

The course was completely rewritten in Learn. After helpful feedback from the Managed Platform Unit, the course was remodelled along the lines of the Information Security Team's "Information Security Essentials" course, and completion of that course became a precondition. At this time the course acquired its final name of Informatics Server Basics.

It was then shown to colleagues (the computing team and some managers of self-managed servers) and their suggestions solicited and incorporated. Parts of the course grew substantially during this process. Lastly it was finalised and opened to self-enrolment, and handed over to the Computing Executive Group for deployment.

Coping with Learn

Writing my first course in Learn was ... an experience.

What I needed was a manual which would tell me how to create a small course. I didn't find one. I did find helpful web pages which told me little bits of what I needed to know, and a large collection of youtube videos (provided by Blackboard, the company behind Learn) each of which clearly explained one single feature of Learn. So, I could learn about Learn's various features, but I didn't have a picture of how they fit together. Nor did I start with much idea of which ones I'd need and which I could ignore.

Our Learning Technologists were happy to help. They created my course for me, and an extra "play" course which I could use to familiarise myself with Learn. However, they didn't have time to help me to learn Learn - they were (understandably) worked off their feet getting academic courses online, so they had to work in the most efficient way they could, which was to offer to put my material online for me, into a Learn course. Unfortunately, since this was a brand new course, I felt unable to develop the material without having an idea of how Learn worked and how the material would be presented, so I didn't take them up on this.

So, I had empty courses to play with. I played about, trying things to see what happened. There were lots of Learn features to try. The working method I arrived at was to ignore almost all of them, and not worry about it. (Many of Learn's facilities are geared towards interacting with a class of students over a semester or session. For a small self-enrol course to be read at a single sitting, most Learn facilities seem irrelevant.)

What I used in Learn

These are the bits of Learn I did use:

Edit mode

At the top right of your course there's a handy little switch which turns "edit mode" ON or OFF. So simple and clear. When it's ON, you can edit your course.


Each bit of content in the course is in an "item". You make an item from the "Build Content" menu (most of which can be ignored). This gives you a rectangle on the page. It comes with its own little menu (most of which can be ignored) where you can select "Edit" to edit the item.

While editing an item, you have an array of layout tools (many of which can be ignored). These should be easy enough to figure out if you've ever used a word processor.

Content Folder

Like items, these can be created using the "Build Content" menu. Your little folder icon will appear on the page, in its own little item-like rectangle. You can edit it to give it a name, and optional content (such as "click here to see the next page"). When you click on it, you're taken to a new page. In this page, you can put stuff (items, content folders). If you want your course material to be split over multiple web pages, rather than forming one single very long web page - and you probably do want this - you can make these pages using Content Folders. To make a multi-part little module, consisting of a number of web pages, you can simply nest Content Folders inside each other! Each time you click "next page" it really takes you one level deeper into your little nest of folders. This is ghastly but simple, and harmlessly amusing, and there's probably a better way to do it.

Course Link

This is the third entry in the Build Content menu which I found useful (I ignored the rest of it). It creates a link to any of your content folders, or to the top level of your course. You can put these links anywhere you like. So, you have a way of (say) making a simple table of contents at the top of your course; or of linking from (say) the end of each module, back to your course's table of contents.

Copy a course you like

Using these Learn facilities, I examined the layout and structure of the "Information Security Essentials" course, worked out how it had been done, and shamelessly reproduced it in my own course. Thanks to Stephen Quinney for suggesting that.

Would I do it this way again?

Yes, I would. Once I'd learned what to do, it was simple and quick to build a small course.

Future work

Periodic review

The course's content will need to be reviewed and brought up to date periodically, to keep it correct, relevant and comprehensive enough. We already do this for pages.

A quiz and a pass certificate

A quiz could be added to the course, testing the participant's knowledge. A suitable score in the quiz could produce a pass certificate, which could be used as proof that the required knowledge had been gained. This work had been envisaged as part of the project, but given the late delivery of the course and the probable extra delay involved in learning how to use Learn's quiz facilities, we decided to postpone this work.

A course on firewall holes

... to educate those requesting a hole in the Informatics firewall. This was suggested by Alastair Scobie during the testing of this Learn course.

Further proposals

See also the related proposals in Stephen Quinney's report Informatics System Compromise - May 2021.

-- ChrisCooke - 28 May 2021

Topic revision: r7 - 25 Jun 2021 - 14:18:35 - ChrisCooke
This site is powered by the TWiki collaboration platformCopyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback
This Wiki uses Cookies