CYBER LIBRARY
Explore the bootcamp
Making change happenIntermediate

Scrum

A lightweight framework for delivering value through inspection and adaptation.

3 min readUpdated 12 Oct 20268 connections
Markdown

The idea

Scrum defines a Scrum Team with a Product Owner, Scrum Master, and Developers, along with events, artifacts, and commitments. Work is organized in Sprints toward a Product Goal. The Product Backlog, Sprint Backlog, and Increment support transparency, while the Definition of Done clarifies quality. The framework depends on real inspection and adaptation rather than simply scheduling ceremonies. Terminology follows the official Scrum Guide.

In practice

A team reviews a usable security improvement with stakeholders and adapts its backlog based on the result.

A common misunderstanding

The daily event is not primarily a status presentation to management, and unfinished work is not a completed Increment.

Check your understanding

Why define Done clearly?

Think it through: It establishes a shared quality threshold so people know what a completed Increment actually includes.

A security increment must be usable

Imagine a team improving an internal access-request service through short delivery cycles. One cycle produces a working approval path for a single low-risk application. Stakeholders can try it, see the audit record, and identify missing context. That is more informative than reviewing a large collection of unfinished forms that cannot support any complete request.

The team keeps its longer-term purpose visible while choosing a coherent near-term goal. New information may change the ordering of future work, but constantly interrupting the current goal can undermine focus. Urgent operational incidents may need a separate response arrangement rather than being disguised as ordinary planned delivery.

Quality cannot wait until the final cycle

Security reviews, tests, and required operational documentation should be integrated into the team's completion threshold. Otherwise, each cycle accumulates work that appears finished but still requires a later hardening effort. The resulting backlog of hidden quality work makes progress harder to interpret.

A demonstration is also an opportunity to inspect assumptions. If a service owner cannot understand the approval record, the team has learned something important about the product. The right response may be to clarify the record before adding more features. Inspection is useful only when the team can adapt based on what it observes.

Apply the framework to a small example

Choose a fictional account-offboarding service. Write a clear purpose, one near-term goal, and a usable result that could be reviewed by the people who operate it. Identify which quality evidence must exist before calling that result complete. Then describe one piece of feedback that would change the next priority. Use the official guide for framework terminology, but judge your example by whether it produces transparent work and meaningful feedback.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

The official Scrum Guide
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

5 notes · 6 connections
100%
Scrum · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (5)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.