OpenCyber Academy
Engineering · Chapter 35 · English
Course code: OCA-121Chapter 35: OCA-121-C035

Chapter 35 — Design studio II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 The studio brief"]
  N2["35.2 Evidence-led redesign"]
  N3["35.3 Presenting and challenge"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 The studio brief"]
  N2["35.2 Evidence-led redesign"]
  N3["35.3 Presenting and challenge"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 The studio brief]
    |
    v
[35.2 Evidence-led redesign]
    |
    v
[35.3 Presenting and challenge]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) redesign a component after evaluation evidence; (2) present design rationale to a mixed audience; (3) respond to challenge constructively.

35.1 The studio brief

The second studio asks teams to redesign one component of the Greyford programme using evaluation evidence gathered so far. Aiko's team chooses the guidance on what to report, because the help channel log and usability tests showed confusion about invoices and newsletters. The brief requires a redesigned guide, a test with at least six staff and a presentation to a panel that includes a finance officer, an operator and a security manager. Teams have three weeks and must document each change and its reason.

35.2 Evidence-led redesign

The team rewrites the guidance as three questions: did you expect this message, does it ask you to act quickly, and does it ask for money, credentials or access. If any answer is worrying, report it. They test the new guide with eight staff using twelve synthetic emails. Correct report decisions rise from nine to eleven out of twelve on average. One tester notes that internal system emails remain hard to judge, so the team adds a short list of genuine system senders that is updated monthly.

35.3 Presenting and challenge

The team presents the redesign in ten minutes, starting with the evidence of confusion. The finance officer challenges whether the three questions would catch a payment fraud from a known supplier's compromised account. The team acknowledges that the guide alone would not, and points to the payment hold control as the defence for that case. The panel values the honest answer. Aiko learns that a design rationale is strongest when it shows how parts of the system cover each other's weaknesses.

Worked example

Aiko's team redesigns reporting guidance as three questions, raises correct decisions from nine to eleven of twelve and answers challenge by pointing to layered controls.

Synthetic case. The studio is synthetic.

Errors and limits

Small tests may not generalise. Lists of genuine senders need maintenance.

Exercises

Synthesis

Redesign grounded in evidence and honest about limits shows how layered controls cover each other.

Continue studying — chapter 35 of 50

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →

Worked answers

EX103. Did you expect it, does it push for speed, and does it ask for money, credentials or access?

EX104. They rose from nine to eleven out of twelve on average.

EX105. The payment hold control, since the guide alone would not catch it.