Capstone -- the analyst's year, reported honestly

capstone · 180 min · Objective 4.2

Task

Take everything this course has produced in your lab and report it as a security programme would: the operational picture, the vulnerability position, the incident record, and whether any of it improved. Unguided, and the final exercise of the course.

Steps

  1. Assemble the artefacts first and note which are missing or stale. That list is itself a finding.
  2. Compute every metric with its denominator and its n, and pair each timing metric with a coverage metric.
  3. Annotate every discontinuity across the period, separating changes in the estate from changes in security.
  4. Write the three audience versions of the vulnerability report from one dataset.
  5. Assess improvement against evidence rather than impression: coverage figures, techniques tested, restore tests completed, actions closed.
  6. Identify the uncomfortable number and write it up plainly -- the invisible techniques, the rules never tested, the median critical age, the incidents you found only because you knew where to look.
  7. Re-read your first lab's output. The distance between it and this is the course.

Verify

ls -1 /tmp/report-*.md /tmp/incident-*.md /tmp/coverage.tsv /tmp/backlog.csv 2>/dev/null | wc -l
awk -F'\t' '$3=="never"' /tmp/detections.tsv | wc -l
awk -F'\t' '$3=="invisible"' /tmp/coverage.tsv | wc -l
comm -23 /tmp/active.txt /tmp/agents.txt | wc -l
awk -F'\t' '$3!="" && $4!=""' /tmp/pir-actions.tsv | wc -l
awk -F'\t' '$5=="closed"' /tmp/pir-actions.tsv | wc -l

The artefact count confirms the set is complete. The next three are the uncomfortable candidates -- rules never proven to fire, techniques with no trace, hosts sending nothing -- and at least one of them belongs in deliverable five. The last two are actions properly specified against actions actually closed, and the gap between them is the honest state of every improvement programme.

Notes

The course ends where it began. An organisation with excellent security and one that has simply not noticed its intrusions produce identical reports, identical green dashboards and identical quiet quarters. Every artefact is the same.

Only a deliberate test -- a hunt, a purple team, a restore, an exercise, a scan you were afraid to run -- tells you which one you are. Deliverable five is you insisting on that test and reporting its result when it is unflattering, which is the job.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.