◇ OpenCyber Academy
Technical · Chapter 18 · English

Chapter 18 — Supervised technical project

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Supervised technical project

Lesson map

Lesson 18 published. Map, example, EX069.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Choosing the project"]
  N2["18.2 Plan"]
  N3["18.3 Safety and privacy"]
  N4["18.4 Measures"]
  N5["18.5 Handover"]
  N6["18.6 Presentation"]
  N7["18.7 Supervision"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX069"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Choosing the project"]
  N2["18.2 Plan"]
  N3["18.3 Safety and privacy"]
  N4["18.4 Measures"]
  N5["18.5 Handover"]
  N6["18.6 Presentation"]
  N7["18.7 Supervision"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX069"]

[Learning outcomes]
    |
    v
[18.1 Choosing the project]
    |
    v
[18.2 Plan]
    |
    v
[18.3 Safety and privacy]
    |
    v
[18.4 Measures]
    |
    v
[18.5 Handover]
    |
    v
[18.6 Presentation]
    |
    v
[18.7 Supervision]
    |
    v
[Worked example] --> [Exercise EX069]

Learning outcomes

You will (1) deliver a small CTI improvement under supervision; (2) plan, build, test and hand over; (3) measure the result; (4) present it to the team.

18.1 Choosing the project

Tomás proposes automating the Monday scam list for the help desk: collect the week's confirmed scam reports from the CTI queue, group by theme, add sample subject lines with personal data removed and advice for callers.

The project meets a real need, because the help desk relies on the Monday list in term time and producing it takes two hours by hand. It also uses skills from the course: parsing, grouping, removing personal data and writing for a non-technical reader. The supervisor approved the scope before any code was written.

18.2 Plan

Week 1: requirements with the help-desk lead. Week 2: build on synthetic data. Week 3: test with past weeks' data on the college server. Week 4: report-only run. Week 5: handover.

Building on synthetic data first means no personal data is processed until the script is tested. Testing on past weeks' data on the college server keeps real reports inside Ashgrove's systems. The report-only run in week 4 produces lists for comparison but does not send them to the help desk. Each week ends with a meeting with the supervisor and a short written status.

18.3 Safety and privacy

Reports contain names and email addresses of students and staff. The script strips them; a person checks each list before release. Only the help desk receives it.

Stripping names and addresses happens before the list is grouped, so the grouping code never handles them. The human check catches anything the script missed, such as a name inside a subject line. Restricting the list to the help desk keeps samples of real scam messages away from wider circulation. Test output on the college server is deleted once the comparison is recorded.

18.4 Measures

Time to produce the list (before: two hours; target: thirty minutes); help-desk satisfaction; accuracy of grouping checked by the supervisor.

The time measure compares production before and after with the same steps counted. Accuracy is checked on the report-only weeks, by the supervisor grouping the same week's reports by hand and comparing the result with the script. Satisfaction is asked of the help-desk lead, since they are the main user of the list. The two-hour figure comes from the help desk's own estimate of the manual process.

18.5 Handover

Runbook, job documentation, owner (the CTI team), kill switch and a short training session for the help-desk lead.

Handover makes the CTI team, not Tomás, responsible for the tool once his placement ends. The runbook and job documentation follow the formats used for other jobs, so the team can maintain it. Training the help-desk lead lets them check that lists look right without needing to read the code. The kill switch is tested in front of the CTI team during handover. The training session is recorded in the project log with the date and attendees.

18.6 Presentation

Ten minutes: problem, solution, results, limits, next steps.

The ten minutes are given to the CTI team and the help-desk lead together. Tomás shows the before and after production times and the library and parking fine example. Limits and next steps are presented plainly, including the need for manual grouping of new themes. Tomás rehearsed the presentation with his supervisor beforehand to keep within the ten minutes. Questions from the team are answered after the talk, and any requested changes are listed in the handover notes. The slides are kept in the repository beside the runbook.

18.7 Supervision

Weekly meetings with the supervisor review progress and risks. Decisions are recorded.

Weekly meetings let the supervisor spot risks early, such as personal data appearing in test output. Recorded decisions show why the project changed, for example the separate fine categories added after help-desk feedback. The record also supports the assessment, because it shows how Tomás responded to advice. Risks raised in meetings are listed with an owner and the date they were closed. The supervisor signs off each stage of the five-week plan before the next begins.

18.8 Limits

The tool groups by keywords; new scam themes may need manual grouping.

A scam theme that uses new words will not match existing keyword rules and will appear ungrouped. The runbook tells the operator to group such items by hand and suggest a new rule. The human check before release catches grouping errors, as it did with the library and parking fines. The help-desk lead knows this limit from the training session. New themes and the rules added for them are recorded in the runbook, so the team can see how the keyword rules grow.

18.9 Reflection

What worked, what he would change, what he learned about users.

Tomás's reflection records that he had not expected callers to need the two fine scams separated. He would ask the help desk for sample calls earlier in requirements next time. He also notes that the report-only run was where the real users' needs became clear. The reflection is written after the presentation, so it can include the team's questions. It forms part of Tomás's course assessment together with the project log and the help-desk sign-off.

Stakeholder sign-off

At the end, the help-desk lead signs a short acceptance note stating that the list meets their needs, and the CTI supervisor confirms ownership. Without both signatures, a student project often stops working when the student leaves.

Worked example

In the report-only run, the tool groups "library fine" and "parking fine" scams together. The help-desk lead says callers need them separate. Tomás adds a rule, and the next run's grouping matches the supervisor's manual check. Production time falls to twenty-five minutes.

Synthetic case. The project and figures are invented.

Errors and limits

Small projects show value but need continued ownership to last.

Exercises

Synthesis

Plan with users, build safely, test with real past data under control, measure, hand over and reflect.

Continue studying — chapter 18 of 18

← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →