Week 18 · lesson

Defend Claims, Limits, and Next Actions

Your final defense is not a sales pitch.

The goal is to show that you understand the system well enough to explain what it does, what can fail, which controls you tested, which evidence supports your conclusions, and where uncertainty remains.

Organize the final dossier

1. Executive summary

One page or equivalent:

system mission;
top three findings;
current overall defensive posture in plain language;
highest-priority next actions;
major limitation.

Do not say “secure” or “100% compliant” unless a precise defined requirement actually supports that phrase.

2. Architecture

Include:

components;
identities;
required flows;
trust boundaries;
dependencies;
controls;
evidence/monitoring paths.

3. Requirements and test matrix

Show expected vs observed results.

Do not hide failed tests.

4. Failure and recovery case

Explain:

baseline
  ↓
failure condition
  ↓
observed evidence
  ↓
mechanism/hypothesis
  ↓
correction
  ↓
recovery + regression test

5. Risk register

Priorities, owners, treatment, verification, residual risk.

6. Monitoring and incident readiness

Which events matter? How do you know telemetry is healthy? Who owns alerts? What evidence supports recovery?

7. Limitations

What did you not test?

What evidence was synthetic?

Which components were outside scope?

Which real-world properties are not represented?

This section increases credibility.

Build a claim-evidence table

Every important statement should map to evidence.

Claim	Evidence IDs	Strength	Limitation
viewer update is denied	E-10	strong for tested case	only represented role/action
logging pipeline detects source loss	E-23,E-24	strong for canary scenario	not every pipeline failure
backup supports recovery	E-30	depends on restore test	only supplied dataset/version

If a claim has no evidence ID, either collect evidence or weaken/remove the claim.

Use language with calibrated confidence

Strong evidence

The frozen capstone configuration denied the tested viewer update action and recorded the expected authorization event.

Medium evidence

The supplied multi-source timeline is consistent with the represented role-change sequence, though one source relies on normalized clock offset.

Unknown

The capstone does not evaluate software vulnerabilities outside the supplied scenario.

These statements are stronger than fake certainty.

Prepare for challenge questions

“How do you know?”

Point to evidence.

“What if that control fails?”

Point to control-health monitoring/recovery.

“Why is this risk first?”

Point to exposure, mission, controls, deadline, uncertainty.

“Could your fix break something?”

Point to regression/required-function test.

“Did you prove the system is secure?”

Correct answer:

No. We tested defined requirements and failure cases in a bounded fictional environment. The dossier records what those tests support and what remains outside scope.

That answer is not weakness. It is engineering honesty.

Leadership defense structure

Keep it short:

Mission
Architecture
Evidence-backed top risks
What controls worked
What failed / what changed
Top next actions
Limitations

Your technical dossier contains the details.

Final rubric

A strong capstone demonstrates:

systems understanding;
architecture reasoning;
evidence provenance;
protocol/service literacy;
authorization boundaries;
input/data contracts;
automation/change control;
telemetry/detection quality;
risk prioritization;
incident/recovery reasoning;
positive + negative + failure + recovery tests;
bounded claims.

Tool quantity does not earn points by itself.

Final submission

Submit the Defensive Systems Review Dossier with:

scope/assumptions;
mission and requirements;
architecture diagram;
evidence registry;
test matrix;
one detailed failure/recovery case;
control coverage map;
risk/remediation register;
monitoring/incident plan;
top-three action roadmap;
executive summary;
limitations;
final reflection.

The course-ending claim

Your final paragraph should be able to say something like:

This review demonstrates that the frozen fictional system met the listed requirements for the tested cases, exposes the failures discovered during the capstone, and links recommended controls to evidence and retests. It does not prove the system is universally secure. The remaining risks, unknowns, and next verification steps are documented.

If you can defend that sentence with your dossier, you finished CS1337 the right way.