◇ OpenCyber Academy
Engineering · Chapter 45 · English

Chapter 45 — Independent design review

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 45 — Independent design review

Lesson map

Lesson 45 published. Map, example, EX133.

flowchart TD
  N0["Learning outcomes"]
  N1["45.1 Preparing the review"]
  N2["45.2 Findings"]
  N3["45.3 Responses"]
  N4["45.4 After review"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX133"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["45.1 Preparing the review"]
  N2["45.2 Findings"]
  N3["45.3 Responses"]
  N4["45.4 After review"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX133"]

[Learning outcomes]
    |
    v
[45.1 Preparing the review]
    |
    v
[45.2 Findings]
    |
    v
[45.3 Responses]
    |
    v
[45.4 After review]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX133]

Learning outcomes

You will (1) prepare a design for independent review; (2) respond to findings; (3) record decisions after review.

45.1 Preparing the review

Before building, Zara submits her capstone design to an independent review panel: a privacy engineer from another company, a researcher and the data protection officer. She provides architecture diagrams, requirements, risk analysis and the verification plan. She also lists her own doubts, such as whether regional aggregation is enough for rare conditions. Prof. Holm explains that admitting doubts helps reviewers focus on real weaknesses rather than hunting for basic errors, and makes the review more useful to everyone involved. Her reviewers receive the code in advance.

45.2 Findings

The panel raises four findings. The researcher says that outcome rates for rare conditions will be too noisy to be useful at regional level. The privacy engineer says that the query log contains researchers' queries, which may reveal sensitive research interests and must be protected. The data protection officer asks how patients will be informed about research use. The engineer also notes that the opt-out check runs at query time, so a patient who opts out mid-study may still appear in cached intermediate results.

45.3 Responses

Zara responds to each finding. For rare conditions she allows national aggregation and a longer accumulation period, trading timeliness for accuracy. She restricts query log access to auditors. She adds a section to the privacy notice and a public register of approved studies. For opt-outs she removes caching of intermediate results and reruns studies from scratch at each release. She records which findings changed the design and which she accepted as residual risks with reasons, so that later reviewers can see the logic of every decision.

45.4 After review

The panel accepts the revised design. Zara notes that the opt-out finding was the most important, because it concerned a patient's right to object that her design would have quietly undermined. She also learns that reviewers with different backgrounds find different problems: the researcher focused on usefulness, the engineer on technical leaks and the data protection officer on transparency. She adds independent review as a standard step for any new data service at Pellmore and offers to serve on future panels. Panels meet quarterly.

Worked example

Zara's design review raises rare-condition noise, sensitive query logs, transparency and cached opt-outs; she responds with national aggregation, restricted logs, a public study register and no caching.

Synthetic case. The panel is synthetic.

Errors and limits

Review panels can miss issues outside their expertise; combine with testing.

Exercises

Synthesis

Chapter 45 strengthens the design. Chapter 46 builds and tests it.

Continue studying — chapter 45 of 50

← Chapter 44 (draft) · Course chapter index · Chapter 46 (draft) →