◇ OpenCyber Academy
Postgraduate · Chapter 11 · English

Chapter 11 — Capstone project

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Capstone project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Choosing the project"]
  N2["11.2 Success criteria"]
  N3["11.3 Delivery"]
  N4["11.4 Evaluation"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Choosing the project"]
  N2["11.2 Success criteria"]
  N3["11.3 Delivery"]
  N4["11.4 Evaluation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 Choosing the project]
    |
    v
[11.2 Success criteria]
    |
    v
[11.3 Delivery]
    |
    v
[11.4 Evaluation]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) define a capstone improvement project; (2) deliver it with evidence; (3) evaluate results against goals.

11.1 Choosing the project

Elena's capstone addresses the risk the board ranked highest: ransomware. Her project combines three improvements already started: clinic patching support, immutable backups with faster recovery and multi-factor authentication for all accounts. The goal is that Moorfield can show, with evidence, that a ransomware attack would be harder to start, slower to spread and faster to recover from. Dr. Qureshi approves the project and asks for clear success criteria. She writes a one-page project charter with scope, timeline and criteria, approved by the operations director.

11.2 Success criteria

Elena sets criteria: critical patch compliance at least ninety-five percent overall and ninety percent in every clinic; multi-factor authentication for every account with documented exceptions; immutable backups for all critical systems; and a timed recovery of the patient record system within four hours. Each criterion has a measure and evidence source. She learns that clear criteria make capstone evaluation straightforward and honest. She lists the criteria in a table with the measure, the data source and the date by which each will be checked. The operations director and the clinical lead sign the table.

11.3 Delivery

Over four months, Elena delivers the improvements. Patch compliance rises above ninety-five percent overall, though one clinic remains at ninety-two percent because of an imaging exception. Multi-factor enrolment reaches all staff accounts, with two service account exceptions documented. Immutable backups cover all critical systems. A final timed recovery completes in three hours and ten minutes. She records evidence for each. She keeps a project log recording the date each milestone was reached and the evidence stored for it. The log, with links to evidence, forms an appendix to her capstone report.

11.4 Evaluation

Elena evaluates honestly. Three criteria are met; the per-clinic patch criterion is narrowly missed in one clinic, with a clear reason and plan. She notes that the project shows improvement in preparation, but cannot prove Moorfield would withstand a real attack. She recommends an independent test of incident response within the next year. Dr. Qureshi praises the honest evaluation as the most important part. She presents the evaluation in a table showing each criterion, the result and whether it was met, with the reason for the missed criterion stated beside it.

Worked example

Elena defines a ransomware capstone with four criteria, delivers patching, MFA, immutable backups and a three-hour ten-minute recovery and evaluates one criterion as narrowly missed.

Synthetic case. Results are synthetic.

Errors and limits

Claiming a project proves resilience against real attacks overstates evidence.

Exercises

Continue studying — lesson 11 (chapter 11 of 12)

← Chapter 10 · Course chapter index · Chapter 12 →

Continue to the next authored lesson.