Chapter 34 — Comparative project

Lesson map

Lesson 34 published. Map, example, EX100.

flowchart TD
  N0["Learning outcomes"]
  N1["34.1 The comparison"]
  N2["34.2 Criteria and evidence"]
  N3["34.3 Recommendation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX100"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["34.1 The comparison"]
  N2["34.2 Criteria and evidence"]
  N3["34.3 Recommendation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX100"]

[Learning outcomes]
    |
    v
[34.1 The comparison]
    |
    v
[34.2 Criteria and evidence]
    |
    v
[34.3 Recommendation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX100]

Learning outcomes

You will (1) compare two approaches to a trust problem; (2) define fair criteria; (3) recommend with justification.

34.1 The comparison

Priya's comparative project asks how Tidewell should give branch staff access to the staff wiki: passwords with one-time codes, or device certificates issued by the internal authority plus security keys for administrators. She defines the problem, the users and the threats, and states that both approaches must work for part-time volunteers who use shared branch computers. Comparisons are fair only when both options are tested against the same requirements. She also sets a time budget so the comparison can finish within the term, and agrees it with Grace and Dr. Echeverría.

34.2 Criteria and evidence

Priya defines criteria: resistance to phishing, effort for staff, administrative effort, cost, behaviour on shared computers and recovery when credentials are lost. She gathers evidence from a two-week trial in two branches, logs support requests and interviews staff. Device certificates remove passwords but fail on shared computers used by several people; one-time codes work anywhere but remain phishable. Security keys resist phishing but cost money and get lost. She tabulates support requests by type, finding that lost one-time code devices cause the most calls during the trial.

34.3 Recommendation

Priya recommends a mixed approach: device certificates to identify branch computers, combined with individual sign-in using passphrases and one-time codes for volunteers, and security keys for staff with access to patron data and for administrators. She justifies each choice by criteria and evidence and states what would change her view, such as lower security-key prices. The comparative method makes her recommendation traceable rather than a matter of preference. Grace accepts the recommendation and asks for a rollout plan covering the twelve branches over two terms.

Worked example

Priya compares access approaches against six criteria in a two-branch trial and recommends device certificates plus individual sign-in, with security keys for privileged staff.

Synthetic case. The trial is invented.

Errors and limits

Short trials miss long-term problems. Mixed approaches add complexity that must be documented.

Exercises

• EX100 — Shared computers. Why do device certificates alone fail for branch volunteers?
  Show marking criteria

  Rubric: 3 = shared computers are used by several people, so devices do not identify individuals;; 2 = shared;; 1 = they work;; 0 = none.
• EX101 — Criteria. List four of Priya's criteria.
  Show marking criteria

  Rubric: 3 = four of phishing resistance, staff effort, admin effort, cost, shared computers, recovery;; 2 = three;; 1 = one;; 0 = none.
• EX102 — Changing view. What would change Priya's recommendation?
  Show marking criteria

  Rubric: 3 = lower security-key prices (or similar evidence change);; 2 = condition;; 1 = vague;; 0 = none.

Synthesis

Comparing options against shared criteria with trial evidence yields traceable recommendations.

Continue studying — chapter 34 of 40

← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →