Chapter 25 — Team project studio
Lesson map
Lesson 25 published. Map, example, EX073.
flowchart TD
N0["Learning outcomes"]
N1["25.1 Roles beat heroics"]
N2["25.2 Planning checklist"]
N3["25.3 Mid-studio review"]
N4["25.4 Conflict on scope"]
N5["25.5 Quiet channels"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX073"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["25.1 Roles beat heroics"]
N2["25.2 Planning checklist"]
N3["25.3 Mid-studio review"]
N4["25.4 Conflict on scope"]
N5["25.5 Quiet channels"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX073"]
[Learning outcomes]
|
v
[25.1 Roles beat heroics]
|
v
[25.2 Planning checklist]
|
v
[25.3 Mid-studio review]
|
v
[25.4 Conflict on scope]
|
v
[25.5 Quiet channels]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX073]
Learning outcomes
You will (1) form a small team with named roles (lead, evidence, liaison); (2) run a planning checklist before any lab work; (3) deliver a mid-studio review against the evaluation criteria from Chapter 23; (4) practise conflict resolution when scope opinions differ.
25.1 Roles beat heroics
Lead keeps the ROE and timeline. Evidence owner runs manifests and custody. Liaison speaks to the (synthetic) white team and SOC. Rotating roles across studios builds breadth; leaving everything to the strongest writer builds a single point of failure.
Each role has a card on the studio wall, photographed into the evidence folder at the start, so there is a record of who held which duty. In the worked example Sam is the liaison and therefore holds the only white-team contact number. Rotating the cards between studios means everyone eventually runs a manifest, keeps an ROE and makes a difficult call to the white team.
25.2 Planning checklist
Agreement fields complete; scope lists loadable by the checker; kit inventory pinned; evaluation criteria written; communication channel tested. No checklist, no lab time. The instructor may fail a studio that cannot produce the checklist at the door.
Every item is answered yes or no at the door. An agreement with an empty exclusion field or a scope list that the checker cannot load means the lab clock does not start, however close the team claims to be. Testing the communication channel before work begins is on the list because a liaison who cannot reach the white team during a HOLD has no safe way to continue.
25.3 Mid-studio review
Halfway through, the team presents: gates passed so far, HOLDs encountered, evidence count, risks to delivery. Instructors score process, not drama.
Platform B's mid-review is a good example: four gates passed, one HOLD on a drifting DNS name and six evidence items hashed. Reporting the HOLD openly earns credit, because it shows the gate working. A HOLD that was hidden and found later costs more than one declared early, since it suggests the team would have kept going without the white team's decision.
25.4 Conflict on scope
When members disagree whether a hostname is in scope, the rule is: stop, re-read the agreement, ask the liaison to confirm with white team. The loudest voice does not win.
Platform B met exactly this case with its drifting DNS name: the team paused that target, and Sam asked the white team for a written decision. The decision is filed under the hostname's evidence identifier, so a later reader can see why the name was tested or left alone. A confident memory of what the scope meant is never a substitute for the signed list.
25.5 Quiet channels
Studio chatter that contains evidence hashes, account names or ROE details stays on the approved channel, not on personal messaging apps. Sam as liaison is the only person who pages the white team. Parallel side chats create conflicting instructions and lost custody.
During the studio the instructors sample messages weekly to check that no hashes or ROE details have leaked into personal SMS or email. The approved channel's log doubles as part of the custody record, showing when each hash was shared and with whom. When two classmates each page the white team, the team ends up with two answers and no clear record of which one applied.
Worked example
Studio team "Platform B" assigns Priya as lead (for the exercise), Jordan as evidence, Sam as liaison. Their mid-review shows four gates passed, one HOLD on a drifting DNS name, six evidence items hashed. They ask for a written decision on the drifted name and pause that target.
Synthetic case. Platform B and its members other than Priya are invented classmates.
Errors and limits
Studios that skip the liaison and "just ping the CISO casually" train bad habits. Keep communications on the approved channel.
Exercises
- EX073 — Role map. Assign lead, evidence and liaison responsibilities in one sentence each. Rubric: 3 = three distinct responsibility sentences; 2 = two; 1 = one; 0 = none.
- EX074 — Drift conflict. Jordan thinks the drifted hostname is "close enough". What does the team do? Rubric: 3 = stop; re-check agreement; liaison confirms with white team; no testing until written OK; 2 = stop only; 1 = test anyway; 0 = none.
- EX075 — Mid-review contents. List four items a mid-studio review should show. Rubric: 3 = four of gates/HOLDs/evidence count/risks/criteria progress; 2 = two; 1 = findings only; 0 = none.
Synthesis
Name the roles, clear the checklist, review the process halfway, and settle scope disputes with the agreement — not volume.
Continue studying — chapter 25 of 30
← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →