◇ OpenCyber Academy
Professional · Chapter 12 · English

Chapter 12 — Practice portfolio and final review

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Practice portfolio and final review

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Portfolio contents"]
  N2["12.2 Sanitising"]
  N3["12.3 Reflection"]
  N4["12.4 Next six months"]
  N5["12.5 Sustaining"]
  N6["12.6 Assessment"]
  N7["12.7 Continuing learning"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Portfolio contents"]
  N2["12.2 Sanitising"]
  N3["12.3 Reflection"]
  N4["12.4 Next six months"]
  N5["12.5 Sustaining"]
  N6["12.6 Assessment"]
  N7["12.7 Continuing learning"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Portfolio contents]
    |
    v
[12.2 Sanitising]
    |
    v
[12.3 Reflection]
    |
    v
[12.4 Next six months]
    |
    v
[12.5 Sustaining]
    |
    v
[12.6 Assessment]
    |
    v
[12.7 Continuing learning]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) assemble a CTI practice portfolio; (2) reflect on growth and gaps; (3) plan the next six months of the role; (4) hand over or sustain the routine.

12.1 Portfolio contents

Requirements list; weekly routine and ticket samples (sanitised); triage scoring with a review; the fraud case report; a control request with verification; a management report; the improvement log; the lab outputs. Each portfolio item shows one routine that Priya built during the six months. The requirements list shows direction; ticket samples show tracking; the scoring review shows triage judged against outcomes. The fraud case report, the MFA request with its sign-in log verification and a management report show analysis and communication. The improvement log and lab outputs show how she checked and refined her own work.

12.2 Sanitising

All portfolio items use synthetic or sanitised content. FSSG material appears only as GREEN summaries or not at all. Staff and clients are never named. Sanitising the portfolio follows the same rules Priya applies to live intelligence work. Ticket samples keep fields and decisions but replace client and staff details with roles. The fraud case keeps the lookalike pattern and timeline shape but not the client or premium. Anything FSSG marked above GREEN is either summarised at GREEN or left out, since the portfolio goes to assessors outside BIB.

12.3 Reflection

What changed at BIB because of CTI? Call-back verification, MFA for remote email, lookalike monitoring. What remains weak? Partner mailbox compromise, limited log retention. Each of these three changes has a dated record behind it at BIB. Call-back verification appears in the operations process and the register, MFA in the pilot's sign-in logs, and lookalike monitoring in the certificate-transparency checks. The two remaining weaknesses are just as concrete and just as well documented. Partner mailbox compromise remained an open question in the fraud case, and limited log retention restricts how far back any investigation can look.

12.4 Next six months

Extend lookalike monitoring to insurer partners; formalise FSSG feedback; train the IT manager as backup; review requirements with the new operations manager. Each item answers a weakness or risk named during the six months. Monitoring partner domains answers the open question from the fraud case. Formal FSSG feedback builds on the monthly notes she already sends to the community. Training the IT manager reduces dependence on one person, and a new operations manager means the requirements written in Chapter 2 need checking against new priorities.

12.5 Sustaining

Document the routine, keep templates, schedule reviews and keep the manager's support by showing outcomes. Documentation is what lets the routine survive Priya's absence or departure. The checklist, ticket fields, scoring rule and report template are kept where the IT manager can find them. Scheduled reviews keep the requirements list and the scoring weights current as BIB changes. Showing outcomes, such as the two prevented fraud attempts, is how she keeps her one day a week allocated. Templates for the ticket, the control request and the report carry the agreed fields, so nobody has to remember them from scratch.

12.6 Assessment

The portfolio is assessed on safety, accuracy, usefulness and reflection, using the course rubric. Safety means nothing in the portfolio breaks TLP, data-protection or OSINT boundaries. Accuracy means the figures and judgments match their evidence, including lab outputs. Usefulness means each item led to a decision or action at BIB, and reflection means Priya names what did not work, such as the false-positive block, alongside what did. Assessors may ask to see routine ticket samples as well as the selected highlights, so both must be ready.

12.7 Continuing learning

Follow ATT&CK and TLP updates, attend FSSG meetings, read sector advisories and consider the technical or postgraduate courses. ATT&CK technique pages and the TLP definitions change over time, so tags and labels need checking against current versions. FSSG meetings keep Priya in contact with peers facing the same fraud methods. The technical course deepens log analysis and detection, while the postgraduate course suits someone moving toward running a CTI programme rather than one part-time role. Each new source or course is still tested against BIB's requirements before it takes any of Priya's limited weekly time.

12.8 Mentoring

Explaining the routine to a colleague confirms that it is documented well enough to survive absence. Teaching the IT manager tests the documentation as a real reader would. If he cannot follow the handover note or the scoring rule without asking, the gap is in the document, not in him. Each question he asks becomes an edit to the checklist, so the routine is clearer before Priya next takes leave. The IT manager's own monthly grading with Priya gives him practice before he covers the full routine alone.

12.9 Celebrate

Note concrete wins: a prevented payment, a blocked lookalike, an avoided outage. Concrete wins are what management remembers when budgets are set. The two prevented fraud attempts reported by operations and the blocked lookalike domain are examples Priya can point to in her portfolio. Recording them at the time, with dates and sources, keeps the claims accurate. It also stops the year's successes being forgotten in favour of recent problems. The one false-positive block, fixed within an hour, belongs in the same record, because honest reporting makes the wins credible.

Feedback from consumers

Before the final review, Priya asks each consumer for one sentence on what CTI changed for them. The operations manager cites call-back verification; the help desk cites Monday scam updates. These quotes, kept anonymous, strengthen the portfolio's evidence.

Worked example

Priya's portfolio review shows twelve control changes traced to intelligence in six months, two prevented fraud attempts reported by operations and one false-positive block, fixed within an hour. Her plan names the IT manager as trained backup and schedules a requirements review in January.

Synthetic case. The figures are invented.

Errors and limits

Portfolios show selected work; assessors may ask to see routine samples.

Exercises

Synthesis

Assemble a sanitised portfolio, reflect honestly, plan ahead, build backup and show concrete value.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →