Lab Guide — Foundations Review

Facilitated exercise · 45 minutes · Fictional organisation

What this lab is

A structured review of the four foundations for a fictional organisation, "Meridian." In groups you will find the implicit-trust, cloud, cryptography, and supply-chain gaps and propose one improvement per pillar. The goal is to practise asking the leader-level questions.

The organisation: Meridian

Brief

Meridian runs a flat internal network, has "moved to the cloud" over two years, encrypts data but has never reviewed key management, and depends on a dozen suppliers — including two small ones with deep system access. No SBOM exists; no supplier is security-audited.

Part A — Trust boundaries (12 min)

Zero trust & cloud

Where does Meridian still rely on implicit trust (flat network, over-broad access)?
In the cloud, what is Meridian's responsibility that it may be neglecting?

Part B — Crypto & long-lived secrets (12 min)

Cryptography

What data must Meridian keep secret for years, making it a harvest-now-decrypt-later target?
What is the first step toward crypto-agility here?

Part C — Supply chain (12 min)

Suppliers

Identify which suppliers can reach Meridian's crown jewels and what minimum security Meridian should require of them. Propose one concrete change.

✓ Self-check: your group named one implicit-trust gap, one cloud-responsibility gap, one long-lived-secret exposure, and one high-access supplier — each with a specific improvement.