OpenCyber Academy
Engineering · Chapter 46 · English
Course code: OCA-120Chapter 46: OCA-120-C046

Chapter 46 — Engineering capstone II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 46 published. Map, example, EX136.

flowchart TD
  N0["Learning outcomes"]
  N1["46.1 Building"]
  N2["46.2 Measuring"]
  N3["46.3 Handover"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX136"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["46.1 Building"]
  N2["46.2 Measuring"]
  N3["46.3 Handover"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX136"]

[Learning outcomes]
    |
    v
[46.1 Building]
    |
    v
[46.2 Measuring]
    |
    v
[46.3 Handover]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX136]

Learning outcomes

You will (1) build and deploy the monitoring service; (2) measure it against success criteria; (3) hand it over for operation.

46.1 Building

Nadia builds the service in stages, starting with the five controls whose evidence is easiest to collect. Each collector is a small script with tests, logging and a clear owner. The scheduler runs collectors daily, stores hashed evidence and raises alerts for failures or missing data. She deploys to a test environment first, then to production with the security manager's approval through change management. She keeps a log of every decision and problem for her thesis. Starting with the five easiest controls lets her test the scheduler and hashing before tackling harder sources.

46.2 Measuring

After two months, Nadia measures against the criteria. Nineteen of twenty controls have automated evidence; one depends on a vendor system without an export, so it remains manual. In tests, alerts arrive within a few hours of a simulated failure. The owner survey shows most owners spending less time on evidence, though two find alerts too frequent. No findings were closed falsely. She reports the results honestly, including the manual control and the alert complaints. Nineteen of twenty meets the criterion of at least eighteen, while the manual control is recorded as a known limit.

46.3 Handover

Nadia hands the service to Ardwell's operations team with a runbook, an owner for each collector, test cases and a list of known issues. She trains two staff to add new collectors. She tunes alert thresholds with the two unhappy owners before leaving. She learns that a capstone is only successful if the client can run it without her, and that handover documentation is as much a deliverable as the code itself. Tuning thresholds with the two unhappy owners addresses the alert complaints recorded in her measurements.

Worked example

Nadia builds the service in stages, meets three criteria fully and one partly with nineteen of twenty controls automated, and hands it over with a runbook.

Synthetic case. The service and measurements are synthetic.

Errors and limits

Two months is short. Survey responses are self-reported.

Exercises

Synthesis

A capstone succeeds when measured honestly against criteria and handed over so others can run it.

Continue studying — chapter 46 of 50

← Chapter 45 (draft) · Course chapter index · Chapter 47 (draft) →

Worked answers

EX136. Nineteen of twenty.

EX137. Because it depends on a vendor system with no export.

EX138. A runbook, an owner for each collector, test cases and a list of known issues.