◇ OpenCyber Academy
Engineering · Chapter 43 · English

Chapter 43 — Industry or public-service practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 43 — Industry or public-service practice

Lesson map

Lesson 43 published. Map, example, EX127.

flowchart TD
  N0["Learning outcomes"]
  N1["43.1 Placement"]
  N2["43.2 Sanitized reporting"]
  N3["43.3 Translation"]
  N4["43.2b Procurement friction"]
  N5["43.3b Conflict of interest"]
  N6["43.1b Clearance and need-to-know"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX127"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["43.1 Placement"]
  N2["43.2 Sanitized reporting"]
  N3["43.3 Translation"]
  N4["43.2b Procurement friction"]
  N5["43.3b Conflict of interest"]
  N6["43.1b Clearance and need-to-know"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX127"]

[Learning outcomes]
    |
    v
[43.1 Placement]
    |
    v
[43.2 Sanitized reporting]
    |
    v
[43.3 Translation]
    |
    v
[43.2b Procurement friction]
    |
    v
[43.3b Conflict of interest]
    |
    v
[43.1b Clearance and need-to-know]
    |
    v
[Practice note]
    |
    v
[Worked example] --> [Exercise EX127]

Learning outcomes

You will (1) adapt platform engineering to a host organization's constraints; (2) write a practice report without client confidential detail; (3) translate between counsel, ops and engineering.

43.1 Placement

In industry or public service, ROE templates, residency and procurement differ. Your job is still fail-closed tooling and honest measurement — not clever unauthorized tests.

Procurement and residency change the architecture options, not the duty to fail closed and measure honestly. Unauthorized cleverness is still out. Sam's placement goals named a fail-closed delivery and a denominator-bearing report, not a surprise test of a partner network. Partner networks stay off the student laptop even when a mentor offers a "quick look." The placement agreement restates that boundary in the host's own words.

43.2 Sanitized reporting

Course deliverables use synthetic names and aggregates. Real client identifiers stay inside the host's systems.

Course markers must not receive real partner names or ticket ids. Synthetic reconstruction agreed with the host is the practice-report format. Sam's memo replaced every real hostname with the Riverstone lab pattern before it left the host laptop. Host review of the sanitized draft is a checkpoint before upload to the course portal. Diffs against the unsanitized internal note are reviewed only on host systems.

43.3 Translation

Counsel hears authorization and retention; ops hears change windows and canaries; engineering hears schemas and tests. Same facts, three dialects.

Synthetic case — Riverstone Transit. Sam's placement memo used only Riverstone synthetic figures; real partner names were omitted.

One fact stated three ways prevents counsel, ops and engineering from talking past each other. In Sam's close-out, counsel's column stated who authorized the scan and how long its logs are kept, ops' column named the change window and the deny-all canary, and engineering's column cited the ScopeVersion schema and its test id. Sam's placement memo opened with a three-column table of the same close-out facts in each dialect.

43.4 Errors and limits

"I can't tell you what I did" is not a practice report — use synthetic reconstruction agreed with the host.

A report that only says work was confidential teaches nothing and fails the course. Agree a synthetic reconstruction with the host that preserves mechanisms without identifiers. Sam's supervisor signed the reconstruction outline before writing began. Mechanisms such as deny-all times and checklist hashes survive sanitization; names do not. A reconstruction without a supervisor signature fails the practice course gate. Unsigned outlines are deleted from the course portal automatically.

43.2b Procurement friction

Public-service hosts may take months to approve a new SaaS. Design the capstone to run on infrastructure the host already authorizes. A perfect architecture that cannot be purchased fails the practice course.

A capstone that needs a new SaaS the host cannot buy in time is a planning failure. Prefer infrastructure already authorized. Sam scoped signed policy distribution on the existing jump hosts after procurement said a cloud scanner would take nine months. Nine months is longer than a capstone; design for the kit already in the binder.

43.3b Conflict of interest

If your placement host sells scanners, your practice report must disclose that and still refuse empty scores. Marketing decks are not measurement.

Sam's disclosure paragraph sat above the metrics so readers saw the relationship before the numbers. Empty scores in a host deck are cited as claims to test, not as results to copy. Graders read the disclosure before scoring the measurement part. The disclosure also names who paid for any licence used in the work, so readers know which tools came from the host. Comparisons between the host's product and other scanners are run on the same synthetic targets and reported with the same denominators.

43.1b Clearance and need-to-know

Public-service placements may involve clearances. Course artefacts stay at the lowest sensitivity: synthetic reconstructions. Never paste classified or restricted text into GitHub.

Sam's repo pre-commit hook greps for the host's internal project codenames and blocks the commit. Hooks that only warn are not enough; the commit must fail closed. Failed commits are logged to the placement supervisor the same day. Before the placement starts, Sam and the host mentor agree in writing which details may appear in course artefacts at all. Anything not on that list stays out of the repo, even in synthetic form. The codename list for the hook comes from that agreement and is updated when the host starts new projects.

Practice note

Practice reports include a constraints appendix: residency, procurement, clearance, change boards. Graders mark the appendix as heavily as the technical work because the course outcome is judgment under constraint, not unconstrained elegance on a personal laptop.

Agree the sanitized reconstruction with the host mentor in writing before writing the practice report.

If the host forbids even sanitized metrics, the practice report uses a fully synthetic twin scenario labelled as such.

43.4b Learning from the placement

Sam keeps a weekly placement journal: one thing learned about how a public transit operator actually runs security, one assumption from the course that did not hold, and one question for his supervisor. The journal becomes the reflective section of his placement report.

The weekly journal forces one broken assumption into the open while memory is fresh. Those entries become the reflective part of the placement report without dumping confidential detail. Sam's note that "calendar overlap beats chat promises" came from a week when two noisy methods collided despite verbal agreement.

Exercises

Synthesis

Practice is real constraints plus sanitized learning artefacts.

Continue studying — chapter 43 of 50

← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →