Chapter 35 — Capstone proposal | Bachelor's Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 Capstone scope"]
  N2["35.2 Requirements and tests"]
  N3["35.3 Plan and measurement"]
  N4["35.4 Risks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 Capstone scope"]
  N2["35.2 Requirements and tests"]
  N3["35.3 Plan and measurement"]
  N4["35.4 Risks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 Capstone scope]
    |
    v
[35.2 Requirements and tests]
    |
    v
[35.3 Plan and measurement]
    |
    v
[35.4 Risks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) define capstone scope and requirements; (2) plan deployment and measurement; (3) manage risks.

35.1 Capstone scope

Priya's capstone deploys option B at two of the four clinics: separate wireless networks for staff, clinical and guest groups; a firewall with the default-deny policy; individual staff wireless accounts; central logging; and the TLS upgrade for the lab results service, which the supplier has agreed to schedule. The other two clinics will follow after the capstone using her documentation. Limiting the capstone to two clinics makes it achievable in one term while still giving real evidence. The two chosen clinics have the most visitors and the most clinical carts.

35.2 Requirements and tests

The proposal lists requirements R1 to R6 from chapter 23 and, for each, the tests and evidence that will show it is met. R1 is tested by attempting connections from a guest test device to each internal group on site, with the clinic's permission and during a scheduled window. R5 is tested by the TLS audit script. R6 is tested by checking the oldest log record after ninety days, which falls after the capstone ends, so she will report it as pending with a configuration check instead.

35.3 Plan and measurement

Deployment happens on two Saturdays, using the rehearsed steps and rollback plan. Measurement follows the study design in chapter 33: four weeks before and four after, with denied and allowed guest-to-internal connection counts and a weekly alert review. Priya schedules a midpoint review with Dr Kowal and the clinic IT lead. Writing the plan as a timeline with named responsibilities makes it easy to see when something slips and what depends on it. Each task on the timeline names who does it and what must be finished first, so delays are spotted early.

35.4 Risks

Priya lists project risks: the supplier delaying the TLS upgrade, a clinical device failing to connect to its new network, the IT lead being unavailable, and bad weather or illness affecting the Saturdays. For each she plans a response, such as reporting the TLS upgrade as out of her control if delayed, testing every clinical device type in the lab first, and booking a reserve Saturday. Managing these risks openly reassures the clinics that their services are protected during the project.

Worked example

The proposal is approved with one change: the clinics ask for guest separation first, a week before the full deployment.

Synthetic case. The proposal is synthetic.

Errors and limits

Capstones that try to cover every site and every control rarely finish with solid evidence.

Exercises

EX103 — Two-clinic scope. Why deploy at two clinics rather than four?
Show marking criteria
Rubric: 3 = achievable in a term with real evidence;; 2 = time;; 1 = cost;; 0 = none.
EX104 — Pending requirement. Why is R6 reported as pending?
Show marking criteria
Rubric: 3 = ninety days falls after capstone; configuration checked instead;; 2 = timing;; 1 = failed;; 0 = none.
EX105 — Clinic change. What change did the clinics request?
Show marking criteria
Rubric: 3 = guest separation first, a week earlier;; 2 = guest first;; 1 = vague;; 0 = none.

Synthesis

A focused scope, testable requirements, a timeline and planned risk responses make the capstone achievable.

Continue studying — chapter 35 of 40

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →