Chapter 18 — Supervised technical project
Lesson map
Lesson 18 published. Map, example, EX069.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Project"]
N2["18.2 Results"]
N3["18.4 Presentation"]
N4["18.5 Reflection"]
N5["18.6 Next"]
N6["Assessment"]
N7["Course review"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX069"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Project"]
N2["18.2 Results"]
N3["18.4 Presentation"]
N4["18.5 Reflection"]
N5["18.6 Next"]
N6["Assessment"]
N7["Course review"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX069"]
[Learning outcomes]
|
v
[18.1 Project]
|
v
[18.2 Results]
|
v
[18.4 Presentation]
|
v
[18.5 Reflection]
|
v
[18.6 Next]
|
v
[Assessment]
|
v
[Course review]
|
v
[Worked example] --> [Exercise EX069]
Learning outcomes
You will (1) complete a supervised project; (2) show measured results; (3) reflect.
18.1 Project
Tomás's project: a storage guardrail pack with policy, verification, alerts, drift check, sharing procedure and runbooks. The pack brings together the course's practical work: the storage policy, the verification script, the public-access alert, the nightly drift check, the signed-link sharing procedure and the runbooks. Each part addresses a cause found in March or a gap found afterwards. The project is supervised by Grace and assessed by Hollins tutors against criteria agreed at the start. Each criterion names the evidence Tomás must show, such as a verification run or a tested runbook.
18.2 Results
Bucket differences fell from 6 to 1 approved exception; drift fell from 3 to 0; public change alert tested at four minutes. These results come from the verification lab's six differences reduced to the one approved exception, the drift lab's three items reduced to zero, and the alert drill that arrived in four minutes. Each figure has saved, dated output behind it in the evidence folder. Tomás presents them with dates so readers can see they were measured, not estimated. The alert time comes from the staging drill rather than a real incident.
18.3 Limits
Results cover one company and a few months. Fairway has four buckets, one cluster and a small team, so results may not carry over to a larger company with many accounts. A few months is too short to show whether drift stays low or whether the alert holds up over time. Tomás states these limits in his report and recommends measuring again after a year. He also notes that results depend on the team keeping the drills and reviews going after he leaves.
18.4 Presentation
He presents to Hollins tutors and Fairway's IT manager. The audience needs different things: tutors want evidence that the criteria were met, while the IT manager wants to know what Fairway now has and what it costs to keep. Tomás shows the before and after figures, a short demonstration of the alert drill and the list of handed-over scripts and runbooks. Questions from the IT manager about new accounts lead to one more checklist item. Tutors ask about limits, and he answers with the points from his report.
18.5 Reflection
He learned that the incident was a process gap as much as a technical one. The technical fixes were quick once the causes were clear; the harder part was providing a safe way to share files and agreeing permission changes with developers. Without the signed-link service, someone with the next urgent partner request might have looked for another workaround. Tomás now asks first what need a risky change was meant to meet. He also learned that a check is only trusted once it has been tested.
18.6 Next
He plans to study application security next. His storage work showed how often the risk sits in code and configuration that developers write, such as the copied example behind driver-photos and the secrets in worker.env. Studying application security will help him review that kind of code before it reaches production. He keeps the habit of testing every check on synthetic data with known answers before using it. He discusses the plan with Grace, who suggests starting with the tracking site's code review. His tutors at Hollins approve application security as his next module of study.
Assessment
Tutors assess the project against criteria agreed at the start: working checks, measured results, documentation tested by another person and honest limits. Tomás meets all four. The tutors note that his timeline in chapter 7 was clear and well evidenced, and suggest that future work could include cost tracking for logging and versioning.
Grace's feedback highlights his habit of testing on synthetic data with known answers before running checks.
Course review
The course moved from understanding Fairway's services, networks and identities, through scope and evidence, to the timeline, causes, policy, configuration, verification, secrets, troubleshooting, automation, partner integration, documentation and drift.
Handover
Before finishing, Tomás hands the scripts and runbooks to the IT team with a short walkthrough.
Safety
All work used synthetic data or read-only access under supervision.
Thanks
He thanks Grace and the developers who joined the reviews.
Future work
Next steps are cost tracking and a check for new accounts.
Closing
The project closes with all actions done.
Worked example
The IT manager asks what would happen if another team opened a new cloud account. Tomás explains that the account-level block and alerts must be applied to new accounts as part of setup, and adds it to the checklist.
Synthetic case. Synthetic.
Errors and limits
Projects judged only on tools miss process changes.
Exercises
- EX069 — Pack contents. What is in the guardrail pack? Rubric: 3 = policy, verification, alerts, drift, sharing, runbooks; 2 = four; 1 = two; 0 = none.
- EX070 — Results. Give the measured results. Rubric: 3 = 6→1 differences, 3→0 drift, 4-minute alert; 2 = two; 1 = one; 0 = none.
- EX071 — New accounts. What was added for new accounts? Rubric: 3 = block and alerts at setup; 2 = partial; 1 = vague; 0 = none.
- EX072 — Lesson. What did Tomás learn about the incident? Rubric: 3 = process gap as well as technical; 2 = partial; 1 = vague; 0 = none.
Synthesis
Show measured results and the process changes behind them.
Continue studying — chapter 18 of 18
← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →