Chapter 38 — Capstone implementation

Lesson map

Lesson 38 published. Map, example, EX112.

flowchart TD
  N0["Learning outcomes"]
  N1["38.1 Building the inventory"]
  N2["38.2 Testing in a seeded environment"]
  N3["38.3 Managing changes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX112"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["38.1 Building the inventory"]
  N2["38.2 Testing in a seeded environment"]
  N3["38.3 Managing changes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX112"]

[Learning outcomes]
    |
    v
[38.1 Building the inventory]
    |
    v
[38.2 Testing in a seeded environment]
    |
    v
[38.3 Managing changes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX112]

Learning outcomes

You will (1) implement the capstone inventory and alerting; (2) test against a seeded environment; (3) manage changes during implementation.

38.1 Building the inventory

Priya implements the capstone. A discovery script connects to authorised hosts, retrieves certificates using the standard library's ssl module and records subject names, issuers, validity dates and fingerprints. Keys are listed from the key service's metadata interface, never by reading key material. Each record links to an owner from the staff directory. An alerting service checks daily for certificates within thirty and seven days of expiry and sends messages to owners and a shared mailbox. The code is reviewed by a classmate before deployment.

38.2 Testing in a seeded environment

Priya seeds a test environment with fifteen certificates: some valid, some expiring soon, some expired and two hidden on unusual ports. Discovery finds thirteen at first, missing the two on unusual ports. She adds those ports to the scan profile after confirming they are within authorisation, and discovery finds all fifteen. Alerts fire correctly for synthetic dates, with one false alert caused by a time-zone error, which she fixes by storing all dates in UTC. She keeps the seeded environment for regression testing.

38.3 Managing changes

Midway, Grace asks whether the tool can also track code-signing keys. Priya assesses the request against the proposal: it would add scope and risk to the timeline. She records it as a future enhancement, agrees with Grace and Dr. Echeverría to keep the original scope, and designs the inventory so the addition is easy later. Managing scope protects delivery and keeps the evaluation meaningful. She also writes a short design note describing how code-signing keys could be added later, so the next maintainer has a clear starting point and estimated effort.

Worked example

Priya's discovery finds all fifteen seeded certificates after adding authorised ports, fixes a time-zone false alert with UTC, and defers code-signing keys as a planned enhancement.

Synthetic case. The environment is invented.

Errors and limits

Time handling causes subtle errors; store UTC. Scans must stay within authorisation even when expanding coverage.

Exercises

• EX112 — Discovery gap. What did discovery miss at first and how was it fixed?
  Show marking criteria

  Rubric: 3 = two certificates on unusual ports; added authorised ports to scan profile;; 2 = missed;; 1 = vague;; 0 = none.
• EX113 — False alert cause. What caused the false alert?
  Show marking criteria

  Rubric: 3 = a time-zone error, fixed by storing dates in UTC;; 2 = time zone;; 1 = bug;; 0 = none.
• EX114 — Scope request. How did Priya handle the code-signing request?
  Show marking criteria

  Rubric: 3 = recorded as future enhancement, kept scope, designed for easy addition;; 2 = deferred;; 1 = added;; 0 = none.

Synthesis

Implementation tested against seeded data and disciplined scope management delivers a reliable capstone.

Continue studying — chapter 38 of 40

← Chapter 37 (draft) · Course chapter index · Chapter 39 (draft) →