OpenCyber Academy
Bachelor's · Chapter 35 · English
Course code: OCA-109Chapter 35: OCA-109-C035

Chapter 35 — Capstone proposal

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 Topic"]
  N2["35.2 Questions"]
  N3["35.3 Data"]
  N4["35.4 Methods"]
  N5["35.5 Ethics and risks"]
  N6["35.6 Deliverables"]
  N7["35.7 Schedule"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 Topic"]
  N2["35.2 Questions"]
  N3["35.3 Data"]
  N4["35.4 Methods"]
  N5["35.5 Ethics and risks"]
  N6["35.6 Deliverables"]
  N7["35.7 Schedule"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 Topic]
    |
    v
[35.2 Questions]
    |
    v
[35.3 Data]
    |
    v
[35.4 Methods]
    |
    v
[35.5 Ethics and risks]
    |
    v
[35.6 Deliverables]
    |
    v
[35.7 Schedule]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) propose a capstone forensic project; (2) define questions, data and methods; (3) address ethics and risks; (4) set deliverables and schedule.

35.1 Topic

Leah proposes: "A complete, reviewed forensic investigation report of the synthetic ws-114 incident, with a reproducible analysis archive and an evaluation of how evidence gaps affected each conclusion."

The topic builds directly on the course: the ws-114 investigation is already partly done, so the capstone can focus on completeness, review and the evaluation of gaps. The evidence-gap evaluation is the original element, asking how each conclusion depends on each source. The scope is fixed in the proposal so the project stays manageable.

35.2 Questions

The four investigation questions, plus a meta-question: for each conclusion, which evidence was decisive and what would change if a source were missing?

The meta-question turns the investigation into a study of its own reliability. Knowing which evidence was decisive for each answer tells the security office which log sources matter most. It also tells readers how fragile each conclusion is: a conclusion resting on one source is weaker than one supported by several independent ones. The sensitivity exercise is how she answers it.

35.3 Data

The synthetic ws-114 image, memory capture and log set provided by the security office for training, extended with a second synthetic host for Q4 testing.

Using training data provided by the security office keeps the work realistic and authorised. The second synthetic host gives Q4 a real test: a host that should show no indicator contact lets her check that her searches do not produce false matches. Both datasets come with acquisition hashes, which she verifies at the start of the project.

35.4 Methods

Timeline analysis, indicator searches, static triage, tool verification, and a sensitivity exercise removing one source at a time to see which conclusions survive.

Most methods were practised in earlier labs; the sensitivity exercise is new. Removing one source at a time and re-deriving conclusions shows which sources each answer depends on. Defining the removals in advance, as the worked example explains, prevents her from choosing removals that make the results look interesting. A classmate repeats two cases by hand as a check.

35.5 Ethics and risks

No real data; samples synthetic; isolated lab. Risks: scope creep (fixed questions), tool failure (second tool), time (milestones).

Each risk has a planned response. Fixed questions stop the project from growing; a second tool covers tool failure; milestones show early if time is running short. Dr Ferreira reviews the risk list at each supervision meeting. The ethics position is simple because all data are synthetic, but it is still stated and approved in writing before work starts, and filed with the proposal.

35.6 Deliverables

Investigation report; analysis archive with scripts and hashes; evidence-gap evaluation; presentation.

Each deliverable serves a different reader: the report for decision makers, the archive for reviewers who want to reproduce the work, the gap evaluation for the security office's planning, and the presentation for the examination panel. Listing them in the proposal lets the panel check at the end that everything promised was delivered. Each deliverable has a named format and location: the report as a PDF, the archive as a folder with a manifest, the evaluation as a chapter of the report, and the slides for the presentation.

35.7 Schedule

Proposal week 2; analysis weeks 3–8; review week 9; report week 11; presentation week 12.

The schedule leaves a gap between review in week 9 and the report in week 11, which absorbs delays. Leah later uses some of that margin when a date-parsing bug delays the draft by a week. Writing the schedule down makes such slips visible and lets her explain them in the evaluation. Each milestone has a concrete output, such as the timeline table by week 5, so progress can be checked rather than estimated. Dr Ferreira uses the milestones to structure supervision meetings.

Supervision plan

Leah and Dr Ferreira agree fortnightly meetings with a short written update before each: progress against milestones, problems, decisions needed. Grace Lin joins two meetings to check the work stays consistent with the security office's procedures. Meeting notes are kept with the project archive, so examiners can see how decisions were made and when the plan changed.

Success criteria

The project succeeds if every finding is sourced and reviewed, the archive reproduces all tables, and the gap evaluation covers each question.

Worked example

Dr Ferreira asks how she will show the sensitivity exercise is fair. Leah answers: each source removal is defined in advance, conclusions are re-derived by a script where possible, and a classmate re-derives manually for two cases to check.

Synthetic case. The proposal is invented.

Errors and limits

A proposal is a plan; record changes and reasons as the project proceeds.

Exercises

Synthesis

A good proposal fixes questions, data, methods, ethics, deliverables and how rigour will be shown.

Continue studying — chapter 35 of 40

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →

Worked answers

EX103. For each conclusion, which evidence was decisive, and how would the conclusion change if that source were missing?

EX104. Each evidence source is removed in turn, and the conclusions are re-derived to see which still hold.

EX105. Removals are defined beforehand, conclusions are re-derived by script where possible, and a classmate manually re-derives two cases as a check.