Chapter 25 — Project planning | Technologist Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 25 — Project planning

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 The project"]
  N2["25.2 Measures"]
  N3["25.3 Scope"]
  N4["25.4 Agreement"]
  N5["Why these measures"]
  N6["Timeline and project risks"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 The project"]
  N2["25.2 Measures"]
  N3["25.3 Scope"]
  N4["25.4 Agreement"]
  N5["Why these measures"]
  N6["Timeline and project risks"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 The project]
    |
    v
[25.2 Measures]
    |
    v
[25.3 Scope]
    |
    v
[25.4 Agreement]
    |
    v
[Why these measures]
    |
    v
[Timeline and project risks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) define a placement project; (2) set measures; (3) agree scope.

25.1 The project

Tomás's project is to measure and improve the trust's endpoint basics over one term: stale accounts, server SSH settings, laptop baseline compliance, encryption and backups.

One term gives enough time to measure, change and measure again, while staying within Tomás's placement. The five areas were chosen with Dev because each had already shown a problem: the supply teacher's account, the SSH settings on two servers, the laptop settings, the encryption gaps and mis01's late backup. Each area already had a script from the earlier chapters, so no new tool was needed.

25.2 Measures

For each area he defines one measure: stale accounts count, servers compliant with the SSH baseline, laptops meeting all baseline settings, laptops fully encrypted and servers with backups within target.

Each measure is a count out of a known total, such as laptops fully encrypted out of 94, so it can be compared directly at the end. Each comes from an existing export and one of the scripts, which means the end measurement can repeat the same method without new access.

25.3 Scope

Out of scope: pupil records, classroom tablets' apps, and any testing that could disrupt teaching.

Pupil records are excluded because the placement agreement does not give access to them. The classroom tablets' apps are left out because the schools' computing leads choose them, though the tablets themselves are counted in the inventory. Excluding disruptive testing means no change is made during lessons and nothing is scanned or attacked. Anything outside scope that Tomás notices is written down for Dev rather than investigated.

25.4 Agreement

The plan is signed by Dev, the trust's business manager and Renée Okafor.

Each signature means something different: Dev agrees to make the changes, the business manager accepts the time and any disruption on behalf of the trust, and Renée confirms the project meets the course requirements. Changes to scope later need the same three people, so the project cannot quietly grow beyond what was agreed. Tomás keeps the signed copy in his placement file for Renée's assessment. Signing before any change is made is what fixes the measures in advance, so they cannot be chosen after results to look good.

Why these measures

Each measure was chosen because it relates to a real risk at the trust and can be produced by a simple script from existing data. Stale accounts relate directly to the supply teacher incident. SSH compliance relates to the servers holding pupil records. Laptop baseline and encryption relate to staff devices that travel. Backup age relates to recovery from ransomware or hardware failure.

Tomás avoids measures that would need new tools or access to personal data, which would slow the project and raise privacy concerns.

Timeline and project risks

The term is divided into three stages: two weeks to measure, six weeks to improve and two weeks to re-measure and report, with a buffer week for school events such as inspections or exams, when changes stop. Tomás also lists the risks to the project itself. Dev may be unavailable; the response is a second contact at the outside company. Changes may disrupt teaching; the response is piloting each change on a few laptops first. Laptops may be offline during measurement; the response is counting them separately rather than guessing. Writing these down at the start means a problem triggers a planned response instead of a scramble.

Worked example

The plan fits on two pages and lists measures, methods, timing and owners.

Synthetic case. The plan is synthetic.

Errors and limits

Measures chosen after results can be selected to look good; fixing them first prevents this.

Exercises

EX073 — Measure list. Name the five project measures. Rubric: 3 = all five;; 2 = four;; 1 = fewer;; 0 = none.
EX074 — Scope exclusion. Why exclude pupil records? Rubric: 3 = privacy and authorisation;; 2 = privacy;; 1 = vague;; 0 = none.
EX075 — Sign-off. Who signs the plan and why each? Rubric: 3 = operator, business, assessor roles;; 2 = names;; 1 = vague;; 0 = none.

Synthesis

A short agreed plan makes the project measurable and safe.

Continue studying — chapter 25 of 30

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →