Chapter 18 — Supervised technical project
Lesson map
Lesson 18 published. Map, example, EX069.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Project brief"]
N2["18.2 Presentation"]
N3["18.3 Handover"]
N4["18.5 Next course"]
N5["18.6 Safety cover sheet"]
N6["18.7 Repository hygiene"]
N7["18.8 Feedback loop"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX069"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Project brief"]
N2["18.2 Presentation"]
N3["18.3 Handover"]
N4["18.5 Next course"]
N5["18.6 Safety cover sheet"]
N6["18.7 Repository hygiene"]
N7["18.8 Feedback loop"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX069"]
[Learning outcomes]
|
v
[18.1 Project brief]
|
v
[18.2 Presentation]
|
v
[18.3 Handover]
|
v
[18.5 Next course]
|
v
[18.6 Safety cover sheet]
|
v
[18.7 Repository hygiene]
|
v
[18.8 Feedback loop]
|
v
[Worked example] --> [Exercise EX069]
Learning outcomes
You will (1) deliver a small authorized testing project on synthetic NMT data; (2) present to a supervisor; (3) hand over runbooks; (4) state remaining limits.
18.1 Project brief
Using only synthetic exports, produce: updated approved-port diff, two validated findings with evidence hashes, one retest tale, one runbook improvement.
Project brief: deliver a scoped ENG-style pack for synthetic NMT — diagram, ROE checklist, lab_ports result, hashes, retest FIXED/STILL OPEN, stop drill record. No fare probes, no production data.
The two lists describe the same pack from two angles: the deliverables above are what the supervisor grades, and the brief names the artefacts that must back them. Every item is built from the synthetic exports, with the fare network left untouched.
18.2 Presentation
Fifteen minutes to the supervisor and a SOC observer.
Sam's presentation opens with the exclusions and the items still open, such as F2, and only then moves to the evidence. Slides that praise tools without hashes behind them fail the presentation gate; any tool praise belongs in an appendix. The SOC observer checks that the stop path shown on the slides matches the one the SOC actually received during the window. Questions from the supervisor about any open item are answered from the evidence, not from memory.
18.3 Handover
Runbooks and scripts in the team repo with versions.
Handover also includes the vault path, the open items and the emergency contacts. Email alone is an incomplete transfer, so a jump-host walkthrough is scheduled, and the transfer checklist requires the calendar invite as an attachment to prove the walkthrough was booked rather than merely promised. A walkthrough lets the receiving technician see the tools running and ask questions before they own the work. The walkthrough also confirms that the receiver can open the vault path before Sam steps away.
18.4 Limits
Sam still does not perform exploit development or threat-led scenario design — topics for longer courses.
The limits page states that the fare network is out of scope, that all work used synthetic data and that Sam has no authority to test real systems. Each limit points to the ROE line that sets it, so examiners can check that the page does not overstate authority. A peer reviews the limits wording before submission, and examiners are told to read that appendix first, because hidden limits invent coverage that never existed.
18.5 Next course
AI security (066) is next in the curriculum path.
Within the red team track itself, the next book is the technologist level, which adds design and integration depth. This technical book ends at procedural competence under an ROE, so design-heavy work waits for that course. Before finishers move on, Sam tells them which habits transfer directly, such as stop discipline and evidence hashing, and which authority does not carry forward to any new engagement. The AI security book named above remains the next title on the wider curriculum path, outside this track.
18.6 Safety cover sheet
Project cover states synthetic-only and no live scanning.
The safety cover sheet repeats the core rules: staging first, the fare network black, the stop conditions and the delete-within retention period. It is page one of the project repository, before any code. A review bot checks that it is the first file reviewers see in the tree, and merges fail if the cover is nested away, so nobody can read the scripts without first reading the limits that govern them. Graders check the cover before any other file in the submission.
18.7 Repository hygiene
Project scripts land in the team repo without credentials, with README and license headers matching NMT policy.
Repository hygiene bans secrets and real inventories; only synthetic inventories may be committed. A secret in git fails the project regardless of the quality of the findings, and so does a clone containing real inventory data. The README must show the disable and stop instructions up front, so anyone who runs the scripts later knows how to halt them before they know how to start them.
18.8 Feedback loop
Supervisor feedback becomes two runbook edits within a week — project done means process improved.
Supervisor comments become runbook patches in the same week, and Sam never archives feedback unread. The links to those same-week patches are pasted into the project handover note. A handover note without them is sent back as incomplete until the links are present, which ensures that the feedback has visibly changed the process rather than being acknowledged and forgotten. The supervisor can then see each comment matched to the change it produced.
18.9 Field discipline
The supervised project cover sheet is single-page: synthetic-only declaration, engagement id of the classroom data pack, list of deliverables with hashes, supervisor signature, and Sam's statement of limits. Without the cover sheet the project is incomplete even if the technical work is excellent.
Field discipline for the project is brief, limits, safety cover, clean repo, honest STILL OPEN. Those five are the pass bar. A project that meets all five passes even when it reports open items, while a project missing one of them fails however polished its findings look.
18.10 Closing note
After acceptance, Sam books a thirty-minute coaching session on OWASP WSTG access-control topics he wants to deepen — continuous learning is part of the project grade at NMT.
The project proves Sam can run ENG-512 habits without a teacher in the room, and portfolio credit needs artefacts proving those solo habits; intention is not enough. The artefacts are the evidence that those habits are real: a pack that shows the stop drill, the hashes and the honest retest statuses earns the mark, while a promise to work that way does not.
18.11 Extra
The SOC observer's question is usually about detection: Sam prepares one ATT&CK technique and one log source he would recommend for each finding.
As an extra, Sam attaches the lab_ports and lab_hash outputs verbatim in an appendix. Examiners can then reproduce the NOT APPROVED, MATCH and MISMATCH lines on their own and diff them against the findings, without needing a meeting to ask how a result was produced. Verbatim output also prevents a summary from quietly softening a result that the tools reported more starkly.
Worked example (synthetic NMT)
Sam's project is accepted with praise for leaving F2 open and for the stop-drill performance in Lab II. He files the cover sheet and next-course plan.
Synthetic case — Northline Municipal Transit (NMT). The transit agency, Sam Park and all figures are invented for teaching.
Errors and limits
Live transit systems and fare equipment are never tested without a separate, specialised authorization. This book uses synthetic data only and grants no authority to test real systems.
Exercises
- EX069 — Deliverables. List four project deliverables. Rubric: 3 = four from brief; 2 = three; 1 = one; 0 = none.
- EX070 — Why leave F2 open. Why is leaving F2 open a strength? Rubric: 3 = honesty; verification integrity; 2 = partial; 1 = weakness; 0 = none.
- EX071 — Limit. Name one skill Sam still must not claim. Rubric: 3 = exploit development or leading threat-led tests; 2 = partial; 1 = port diffs; 0 = none.
- EX072 — Next course. What is course 066? Rubric: 3 = AI security; 2 = AI; 1 = wrong; 0 = none.
Synthesis
The technical project proves disciplined testing craft on synthetic data and honest limits.
Continue studying — chapter 18 of 18
← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →