Chapter 50 — Final defense | Engineering Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 50 — Final defense

Lesson map

Lesson 50 published. Map, example, EX148.

flowchart TD
  N0["Learning outcomes"]
  N1["50.1 Preparation"]
  N2["50.2 Challenges"]
  N3["50.3 Outcome"]
  N4["50.4 Continued learning"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX148"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["50.1 Preparation"]
  N2["50.2 Challenges"]
  N3["50.3 Outcome"]
  N4["50.4 Continued learning"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX148"]

[Learning outcomes]
    |
    v
[50.1 Preparation]
    |
    v
[50.2 Challenges]
    |
    v
[50.3 Outcome]
    |
    v
[50.4 Continued learning]
    |
    v
[Worked example] --> [Exercise EX148]

Learning outcomes

You will (1) defend engineering work before examiners; (2) answer challenges about evidence and generalisation; (3) plan continued learning.

50.1 Preparation

Lindiwe prepares a thirty-minute presentation: the problem, the design, the review findings, the trials and the evidence. She rehearses with classmates who ask hostile questions. She prepares backup slides with timelines and checksum records. Prof. Hale advises her to answer only what she can support and to say clearly when a question goes beyond her evidence, because examiners respect precise limits more than confident guesses. She also prepares a short demonstration of the restore verification script running on synthetic files, in case examiners ask to see it working.

50.2 Challenges

An examiner asks whether the recovery would work if attackers had been inside the network for months. Lindiwe answers that immutable backups cover a fixed period and that week-old restore tests passed, but that longer undetected compromise could contaminate backups; detecting intrusions sooner is the complementary control. Another asks why she trusted checksums recorded on the backup system; she explains that the manifest is itself stored immutably with the backups. A third examiner asks about cost, and she shows the hardware reused for the environment.

50.3 Outcome

The examiners pass Lindiwe with commendation, praising the measured trials, the independent review and the dossier. They suggest she publish the recovery method as a practitioner guide. Saltmarsh offers her a role in its security team. She reflects that the course connected mathematics, systems and management into one engineering practice aimed at protecting a real organisation's information. She accepts the role and agrees to lead the next annual recovery trial. The examiners' report recommends her dossier as an example for future students, and Prof. Hale asks her to speak to next year's cohort about the capstone.

50.4 Continued learning

Lindiwe plans continued learning: professional certification, deeper study of incident response and keeping her recovery skills current through Saltmarsh's annual trials. Prof. Hale reminds her that standards and threats change; ISO/IEC 27000 itself was revised in 2026. The next course in this area, data governance, examines how decisions about data quality, ownership and use are made, which complements the security controls she has built. She also plans to mentor a placement student at Saltmarsh, passing on the habits she learned: measuring carefully, testing at boundaries and stating limits.

Worked example

Lindiwe defends her recovery work, answers challenges on long-term compromise and checksum trust, passes with commendation and plans continued learning.

Synthetic case. The defense is synthetic.

Errors and limits

Answering beyond one's evidence undermines a defense.

Exercises

EX148 — Long compromise. What complements immutable backups against long compromise? Rubric: 3 = detecting intrusions sooner;; 2 = partly correct;; 1 = vague;; 0 = none.
EX149 — Manifest storage. Where is the checksum manifest stored? Rubric: 3 = immutably with the backups;; 2 = partly correct;; 1 = vague;; 0 = none.
EX150 — Defense result. What is the outcome of the defense? Rubric: 3 = pass with commendation;; 2 = partly correct;; 1 = fail;; 0 = none.

Continue studying — lesson 50 (chapter 50 of 50)

← Chapter 49 · Course chapter index · Next course via chapter index →

The chapter index leads to the next course in the study path.