◇ OpenCyber Academy
Professional · Chapter 12 · English

Chapter 12 — Capstone: the first year in review

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Capstone: the first year in review

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Goals revisited"]
  N2["12.2 Real incident"]
  N3["12.3 Comparison with March"]
  N4["12.4 Reflection"]
  N5["12.5 Ethics"]
  N6["12.6 Next steps"]
  N7["Costs"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Goals revisited"]
  N2["12.2 Real incident"]
  N3["12.3 Comparison with March"]
  N4["12.4 Reflection"]
  N5["12.5 Ethics"]
  N6["12.6 Next steps"]
  N7["Costs"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Goals revisited]
    |
    v
[12.2 Real incident]
    |
    v
[12.3 Comparison with March]
    |
    v
[12.4 Reflection]
    |
    v
[12.5 Ethics]
    |
    v
[12.6 Next steps]
    |
    v
[Costs]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) evaluate a year of security operations against goals; (2) present results to leadership; (3) reflect on professional practice; (4) plan your own next steps.

12.1 Goals revisited

Log coverage: critical 5/5, high 4/4 by month ten. Tested response plan: two tabletops, one real incident handled. Thirty-minute handling: median critical acknowledge 9 minutes, worst 26. Each goal from the board paper is checked against evidence. Coverage comes from the coverage table, response testing from the tabletop records and the month-nine incident, and handling time from the provider's acknowledgement records. The worst case of 26 minutes was the second provider test, before the backup analyst was added. Priya presents both the 9-minute median and the 26-minute worst case, so the board sees typical performance and the night the target was missed.

12.2 Real incident

In month nine, a buyer's account was phished. The provider saw a new-country login at 02:14, disabled the account at 02:19 under pre-approved authority, and called Priya. MFA on the VPN had blocked the attacker; the account had only been used for webmail. No data was taken. The incident tested every part of the SOC built during the year: the new-country rule fired, the provider acted under authority, and the service level was met. Priya records the timeline and reviews it with the provider.

12.3 Comparison with March

In March, the alert sat unseen for nine hours and 1.4 GB left. In month nine, response took five minutes and nothing left. The difference shows what the year changed: an owned queue, written authority, a provider watching at night and MFA on the VPN. Priya is careful not to claim that every future attack will be stopped. The month-nine attacker was blocked by MFA, and the account was disabled quickly. She presents the comparison to the board as evidence that the investment worked in one real case, alongside the remaining risks.

12.4 Reflection

Priya notes what she would change: hire the analyst earlier, share business context with the provider from day one, and involve the factory earlier. Each change comes from a problem in the first year. Tom joined after the provider had started, so the provider worked without daytime follow-up at first. The travel calendar was shared only after a night call about the sales manager. The factory's concerns about isolation surfaced late in the charter workshop. Priya writes these lessons into her final report, so other small manufacturers can plan better from the start.

12.5 Ethics

Monitoring staff is sensitive; the staff council's annual review found no misuse. The review checked who accessed monitoring data and why, and found that it had been used only for security. The staff council's report goes to the managing director and is summarised for staff, so they can see that the limits in the charter were followed. The review will continue each year, and Priya will report any concerns raised by staff. She considers this review as important as any technical metric, because the SOC depends on staff trust.

12.6 Next steps

Priya plans further study in incident response and resilience; Tom starts a technical course. Priya's study will deepen her knowledge of response planning, which she now leads at Fenwick. Tom's course will help him improve rules and investigations, and support the year-two quarterly rule reviews. Both plans are part of the year-two budget approved by the board. Priya also plans to share Fenwick's experience with other manufacturers in her region, describing the hybrid model and its first-year results. Tom's course is scheduled around his morning review of night notes, and the provider covers daytime triage on his study days.

Costs

The first year cost the provider fee, Tom's salary, MFA licences and log storage; Priya compares this with the estimated cost of the March data loss.

Personal practice

Priya keeps a learning log through the course and the year: what she tried, what worked and what she changed. Writing it forced her to explain decisions, which helped when the board asked why.

Worked example

Priya presents the year to the board in ten minutes: the March story, the goals, the month-nine contrast, the costs and the year-two plan. The managing director asks what would happen if the provider failed; Priya points to the exit terms and data ownership in the agreement.

Synthetic case. Year results are invented.

Errors and limits

One year of good results does not prove future resilience; keep testing.

Exercises

Synthesis

Measure the year against its goals, tell the story plainly and keep improving.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →