Chapter 50 — Final defense
Lesson map
Lesson 50 published. Map, example, EX148.
flowchart TD
N0["Learning outcomes"]
N1["50.1 Preparing the defense"]
N2["50.2 Answering trade-off questions"]
N3["50.3 Ongoing responsibility"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX148"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["50.1 Preparing the defense"]
N2["50.2 Answering trade-off questions"]
N3["50.3 Ongoing responsibility"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX148"]
[Learning outcomes]
|
v
[50.1 Preparing the defense]
|
v
[50.2 Answering trade-off questions]
|
v
[50.3 Ongoing responsibility]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX148]
Learning outcomes
You will (1) defend design decisions before an examining panel; (2) answer questions about security trade-offs; (3) reflect on the engineer's ongoing responsibility.
50.1 Preparing the defense
Aiyana prepares a twenty-minute presentation: the problem, key design choices, evidence and limits. She anticipates questions: why symmetric keys for readings, why three of five custodians, why hybrid post-quantum signatures, and what happens if the key service is compromised. For each she prepares a concise answer pointing to evidence in the thesis or dossier. Marcus and her supervisor run a mock defense, pressing her on cost assumptions she had not fully justified, which she strengthens. She rehearses answers aloud until each fits in under two minutes.
50.2 Answering trade-off questions
During the defense an examiner asks why Ridgeway did not use public-key signatures for readings to remove central key risk. Aiyana explains the 32-byte message budget and energy constraints, the mitigations for central risk (HSMs, per-meter derivation, monitoring and dual control) and the condition under which she would reverse the decision. Another examiner asks whether her lab code could be used in production; she answers firmly that it could not, because it exists to verify understanding against test vectors, while production relies on vetted libraries.
50.3 Ongoing responsibility
In closing, Aiyana reflects that the trust service will outlive her involvement. Algorithms will be deprecated, quantum computing may mature, staff will change and threats will evolve. Her responsibility as an engineer is to leave a system that others can understand, operate, test and change safely, with documentation, runbooks, metrics and an evidence trail. The panel passes her thesis, noting the clarity of its limits. She begins work at Ridgeway as a security engineer the following month. She schedules her own first review of the system for one year later.
Worked example
Aiyana defends the symmetric reading design, the custodian quorum and hybrid migration, refuses to call lab code production-ready, and frames her responsibility as leaving a maintainable system.
Synthetic case. The defense and outcome are invented.
Errors and limits
Defending every decision as perfect undermines credibility; acknowledge trade-offs. Engineering responsibility continues after handover.
Exercises
- EX148 — Mock defense lesson. What weakness did the mock defense expose? Rubric: 3 = cost assumptions not fully justified;; 2 = costs;; 1 = vague;; 0 = none.
- EX149 — Central risk mitigations. Which mitigations did she cite for central key risk? Rubric: 3 = HSMs, per-meter derivation, monitoring, dual control;; 2 = three;; 1 = one;; 0 = none.
- EX150 — Engineer's responsibility. How does Aiyana describe her ongoing responsibility? Rubric: 3 = leave a system others can understand, operate, test and change safely with documentation and evidence;; 2 = partial;; 1 = vague;; 0 = none.
Synthesis
A defense shows mastery by explaining trade-offs honestly, and engineering responsibility continues through the system's whole life.
Continue studying — chapter 50 of 50
← Chapter 49 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →