OpenCyber Academy
Engineering · Chapter 50 · English
Course code: OCA-132Chapter 50: OCA-132-C050

Chapter 50 — Final defense

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 50 published. Map, example, EX148.

flowchart TD
  N0["Learning outcomes"]
  N1["50.1 Presentation"]
  N2["50.2 Technical questions"]
  N3["50.3 Forensic questions"]
  N4["50.4 Ethical questions"]
  N5["50.5 Handling unknowns"]
  N6["50.6 Outcome"]
  N7["50.7 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX148"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["50.1 Presentation"]
  N2["50.2 Technical questions"]
  N3["50.3 Forensic questions"]
  N4["50.4 Ethical questions"]
  N5["50.5 Handling unknowns"]
  N6["50.6 Outcome"]
  N7["50.7 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX148"]

[Learning outcomes]
    |
    v
[50.1 Presentation]
    |
    v
[50.2 Technical questions]
    |
    v
[50.3 Forensic questions]
    |
    v
[50.4 Ethical questions]
    |
    v
[50.5 Handling unknowns]
    |
    v
[50.6 Outcome]
    |
    v
[50.7 Reflection]
    |
    v
[Worked example] --> [Exercise EX148]

Learning outcomes

You will (1) present the engineering thesis to examiners; (2) answer technical, forensic and ethical questions; (3) demonstrate the system; (4) reflect on the five-year path.

50.1 Presentation

Twenty minutes: problem, requirements, design, validation, pilot results, limits, contribution. A five-minute live demonstration on synthetic items shows intake, verification blocking, chain tamper detection and export verification.

Twenty minutes allows only the essentials, so Priya builds the talk around the evidence chain from problem to result rather than the history of the project. The live demonstration is rehearsed several times on the presentation laptop, with a recorded backup in case anything fails. Tamper detection is shown by editing a record in front of the panel and running verification, which makes the main idea concrete.

50.2 Technical questions

"Why SHA-256 and not a newer function?" Widely standardised, supported by validated tools and published vectors; EvidenceDesk stores the algorithm with every digest so others can be added. "Why not a blockchain?" A hash chain with external anchoring gives tamper evidence for one lab without the complexity of distributed consensus.

Good answers address the reasoning, not just the choice. On SHA-256, Priya notes that recording the algorithm alongside each digest means a move to another function would not invalidate old records. On blockchain, she explains that distributed consensus solves trust between many parties who do not trust each other, while Northfield's problem is detecting changes inside one organisation, which external anchoring already handles.

50.3 Forensic questions

"How would a defence expert challenge your records?" By questioning anchoring, clock accuracy or exceptions; Priya shows the anchor procedure, drift check and exception reconciliation records.

The question invites Priya to attack her own system, which shows whether she understands its weak points. She names the realistic challenges rather than claiming there are none, and for each shows the record that answers it. A panel member pushes on exceptions during the power cut; she shows the scanned paper forms, reconciliation notes and the second-person checks for each one.

50.4 Ethical questions

"Did examiners feel monitored?" The survey was voluntary and anonymous; logs record actions on evidence, which is required practice, not personal monitoring.

The distinction between recording actions on evidence and monitoring people matters to staff trust. Custody logs exist to protect evidence and are expected practice in forensic labs. EvidenceDesk does not record keystrokes, idle time or productivity measures, and its reports are not used for performance reviews, which the lab confirmed in writing before the pilot started. Priya presents that confirmation to the panel.

50.5 Handling unknowns

Asked about performance on 50 TB cases, Priya says she has not measured it and explains how she would.

Admitting she has not measured something is stronger than guessing, because a guess that proves wrong would cast doubt on her other answers. She outlines the method: a synthetic 50 TB data set split across drives, timing ingest and verification queues, and checking that memory stays flat. Her capacity arithmetic gives a rough estimate of reading time, which she offers clearly labelled as an estimate.

50.6 Outcome

The panel requests minor corrections: clarify the exception statistics table.

Minor corrections mean the thesis passes once the changes are made, without another defence. The exception table mixed counts from the pilot and from the failure trial in one column, which confused two panel members. Priya splits it into separate tables with clear headings, and her supervisor confirms the revision before final submission. The panel also suggests two wording changes in the limitations chapter, which she makes at the same time, noting them in the corrections letter.

50.7 Reflection

Calculus estimated imaging time; discrete mathematics framed filters; architecture decoded timestamps; ethics shaped the vendor decision; systems engineering defined interfaces; each early course reappeared in EvidenceDesk.

The list shows how earlier courses turned into concrete tools: imaging-time estimates rested on rates and arithmetic; filter logic used sets and predicates; decoding file-system timestamps needed knowledge of binary formats; the decision against an unauditable vendor product drew on professional ethics. Priya notes that the courses she found driest at the time turned out to be the ones she used most often in the capstone.

50.8 After graduation

Northfield keeps EvidenceDesk running with the IT officer as owner and schedules revalidation.

A system that outlives its builder is the best evidence that maintainability work paid off. The IT officer runs the daily checks, makes releases and schedules revalidation for the next imager update. EvidenceDesk's dossier and documentation stay at Northfield, where future staff and auditors can follow how the system was designed, tested and approved. She leaves her contact details for questions. The first revalidation is booked within the year, and the IT officer records it in the change log.

Worked example

During the demo, a panellist edits a custody file in a text editor. Priya runs verification: the broken link is reported at the edited entry, and the anchor comparison confirms it. She then shows the proper correction path, which appends an entry and keeps the chain intact.

Synthetic case. The defence is invented.

Errors and limits

A demonstration shows behaviour on chosen inputs; validation records carry the broader claim.

Exercises

Synthesis

Defend with demonstrations, records and honest limits; the whole curriculum converges in the final system.

Continue studying — chapter 50 of 50

← Chapter 49 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →

Worked answers

EX148. For a single lab, a hash chain anchored externally already makes tampering evident, without the complexity of distributed consensus.

EX149. Say plainly that it has not been measured and describe the test that would answer it.

EX150. Verification reported a broken link at the edited entry, the anchor comparison confirmed it, and the proper append-only correction kept the chain intact.