Chapter 43 — Industry or public-service practice
Lesson map
Lesson 43 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["43.1 The placement"]
N2["43.2 Professional practice"]
N3["43.3 Theory versus practice"]
N4["43.4 Confidentiality"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["43.1 The placement"]
N2["43.2 Professional practice"]
N3["43.3 Theory versus practice"]
N4["43.4 Confidentiality"]
N5["Engineering note"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX085"]
[Learning outcomes]
|
v
[43.1 The placement]
|
v
[43.2 Professional practice]
|
v
[43.3 Theory versus practice]
|
v
[43.4 Confidentiality]
|
v
[Engineering note]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) work within a real-shaped migration team under supervision; (2) apply professional practices — change control, documentation, stakeholder communication; (3) reflect on gaps between theory and practice; and (4) produce a placement report without disclosing confidential information. It begins the practice and capstone stage.
43.1 The placement
A placement in a security team, a vendor, a public agency or a standards organization exposes the realities of migration: procurement cycles, legacy systems, partner politics, change freezes. In this book the placement is simulated at BPA; in a real programme, the host's confidentiality rules apply.
The placement teaches what the classroom cannot: a change freeze can delay a ready migration by a month, and a vendor's answer can take eight weeks. Students learn to plan around such delays rather than treat them as exceptions.
43.2 Professional practice
Follow change control: every cryptographic change has a ticket, risk assessment, test evidence, approval and rollback plan. Document decisions with rationale. Communicate progress in the host's language — risk and service impact rather than algorithm names.
In practice, a ticket for enabling the hybrid group on the partner API names the service, the change, the test evidence from the lab, the canary plan and the rollback command. Reporting progress as "customs replication now protected against recording" means more to managers than "X25519MLKEM768 enabled". The placement student writes both versions for each change.
43.3 Theory versus practice
Common surprises: inventory is harder than algorithm selection; vendors' "PQC-ready" claims vary from roadmaps to shipping features; partners set the pace; the hardest problems are organizational. Record these as reflective notes.
BPA's placement notes show this pattern: the algorithm decisions took days, while finding all uses of RSA took months. Vendor claims needed checking against shipping releases. Reflective notes record each surprise and what the student would plan differently next time, which is the main learning outcome of the placement. Students compare their notes with the plan they wrote at the start to see where their expectations were wrong.
43.4 Confidentiality
The placement report describes methods and lessons without identifying systems, vulnerabilities or partners. Use synthetic examples where needed and get host approval before submission.
A placement report can describe the dashboard method and the lesson about first-offered groups without naming the library or the host's systems. Where a concrete example is needed, the student uses BPA's synthetic case instead. Host approval is a step in the submission process with its own date, so the report is not delayed at the last moment by an unexpected request for changes.
43.5 Worked example
A placement student at BPA (synthetic) builds the passive-telemetry dashboard. Lessons recorded: one TLS library logged only the "first offered" group, not the negotiated one — the dashboard was wrong until fixed; vendor declarations for appliances took eight weeks to obtain; the change board required a rollback rehearsal before approving hybrid TLS on the partner API.
The logging error is a typical placement finding: the dashboard looked plausible until the student compared it with wire captures, the method later formalized in attacker's-vantage verification. The rollback rehearsal requirement shows that change boards care about recovery as much as about the change itself.
43.6 Common errors and limits
- Bypassing change control "because it's only configuration".
- Reports that disclose host vulnerabilities.
- Treating vendor roadmaps as shipped capability.
Configuration changes can break production as badly as code changes, as the proxy reset showed, so they follow change control. Reports that disclose host vulnerabilities can harm the host and breach the placement agreement. Vendor roadmaps describe intentions; only shipped and tested features count in a migration plan, and the placement student records which is which in the CBOM with the date checked.
Engineering note
Placements also teach how decisions are actually made. Observe who approves cryptographic changes, what evidence they ask for, which risks they accept and which they escalate. Record these observations without names. Students who understand the decision path write better designs in Capstone I, because they anticipate the questions of the change board, the procurement office and partner managers instead of discovering them at the end.
Exercises
- EX085 — Change ticket. Write a change ticket for enabling hybrid TLS on one internal service. Rubric: 3 = risk, tests, approval, rollback.
- EX086 — Reflection. Write a 300-word reflection on one theory-practice gap. Rubric: 3 = specific, analytic, confidential.
Synthesis
Practice teaches that migration is organizational as much as technical; change control, documentation and confidentiality are professional obligations.
Continue studying — chapter 43 of 50
← Chapter 42 (draft) · Course chapter index · Chapter 44 (draft) →