◇ OpenCyber Academy
Postgraduate · Chapter 11 · English

Chapter 11 — Applied project

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 11 — Applied project

Lesson map

Lesson 11 published. Map, example, EX051.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 The project"]
  N2["11.2 Baseline"]
  N3["11.3 Interventions"]
  N4["11.4 Stakeholders"]
  N5["11.5 Risks"]
  N6["11.6 Measurement"]
  N7["11.7 Result"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX051"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 The project"]
  N2["11.2 Baseline"]
  N3["11.3 Interventions"]
  N4["11.4 Stakeholders"]
  N5["11.5 Risks"]
  N6["11.6 Measurement"]
  N7["11.7 Result"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX051"]

[Learning outcomes]
    |
    v
[11.1 The project]
    |
    v
[11.2 Baseline]
    |
    v
[11.3 Interventions]
    |
    v
[11.4 Stakeholders]
    |
    v
[11.5 Risks]
    |
    v
[11.6 Measurement]
    |
    v
[11.7 Result]
    |
    v
[Worked example] --> [Exercise EX051]

Learning outcomes

You will (1) plan and execute an applied SOC improvement project; (2) measure baseline and outcome; (3) manage stakeholders and risks; (4) report results for decision-makers.

11.1 The project

Daniel's applied project reduces time to contain compromised contractor accounts, the weakness exposed in chapter 1. The contractor incident showed that containment depended on reaching contractor managers, which often failed at night. The project tests whether changes to contacts, confirmation and authority shorten that time without causing unfair disruption to contractors. Daniel sets the measures before starting, so the result can be judged against the six-month baseline rather than an impression. The project's scope is contractor accounts only; staff accounts follow the existing process.

11.2 Baseline

Over the previous six months, four contractor compromises took a median of 3.5 hours from first alert to containment, mostly waiting for contractor managers to confirm activity. Four cases make the baseline imprecise, and Daniel reconstructed it from tickets after the fact, which he later named as the main thing he would do differently. Still, the pattern was clear: most of the time was spent waiting for a contractor manager to answer. The interventions target that wait directly. Daniel names timestamps recorded as cases happen, not reconstructed from tickets afterwards, as the requirement for any better baseline.

11.3 Interventions

A contractor directory with 24/7 contacts; an automated step that sends the contractor's manager a confirmation request; and a rule allowing analysts to suspend contractor export rights immediately for high-severity alerts, with review within four hours. Each intervention targets the waiting time found in the baseline. The directory removes the search for a contact at night; the automated request reaches the manager without an analyst drafting a message; and the suspension rule lets analysts act before confirmation arrives. Limiting suspension to export rights and requiring review within four hours keep the authority proportionate to the uncertainty.

11.4 Stakeholders

Procurement (contracts must require 24/7 contacts), contractor managers, IT and legal. Procurement adds a clause to new contracts. Each stakeholder had a stake in the design. Contractor managers needed to know what a confirmation request would look like and how quickly to answer; IT needed a way to suspend export rights alone; legal checked that suspension without notice fitted the contracts. Daniel met each group before launch, which made the first suspension less of a surprise to everyone involved. Legal checked the suspension clause against existing contractor agreements before the first suspension took place.

11.5 Risks

Wrongful suspension disrupts contractor work; mitigated by fast review and limiting suspension to export rights, not all access. The project counts wrongful suspensions as a measure, so the cost of the new rule is visible beside its benefit. Contractor managers can ask for immediate review, and every suspension is checked by a senior analyst within four hours. Limiting the action to exports means a wrongly suspended contractor can still do most of their work while the review takes place. This keeps the authority proportionate to the uncertainty at the moment of the alert.

11.6 Measurement

Time to contain for contractor compromises and test scenarios; count of wrongful suspensions. Time to contain is measured from the first alert to the suspension of export rights, using case-system timestamps, the same definition as the baseline. Test scenarios are reported beside real compromises, because they are planned and may run faster. Wrongful suspensions are counted with their duration, so the cost of the new rule is visible next to its benefit. Daniel fixed these definitions before the first case under the new process.

11.7 Result

Over the next four months, two real compromises and six test scenarios were contained in a median of 22 minutes. One wrongful suspension lasted 40 minutes before review restored access. The sample is small and mixes real cases with test scenarios, so Daniel describes the result as a large improvement on a small sample rather than a precise figure. The wrongful suspension shows the review step working; it also shows the real cost of acting early, which he reports rather than hides.

Project governance

The project has a sponsor (the CISO), a fortnightly check-in and a simple risk log. When procurement's legal review delayed the contract clause by three weeks, the log made the slip visible early and Daniel adjusted the plan to start with existing contracts' contacts instead of waiting.

Ethics of testing

Test scenarios used dedicated test contractor accounts, approved in writing by the CISO, so no real contractor was suspended for a test.

Worked example

Daniel's project report to the CISO: baseline 3.5 hours; outcome 22 minutes median (small sample); one wrongful suspension, reviewed promptly; recommendation to keep the process and extend the 24/7 contact clause to renewing contracts.

Synthetic case. The project is invented.

Errors and limits

Two real cases and six tests are few; the effect estimate is uncertain.

Exercises

Synthesis

Applied projects improve SOCs when baselines, interventions, risks and outcomes are measured and reported plainly.

Continue studying — chapter 11 of 12

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →