1. Courses
  2. Security Foundations
  3. Capstone

Capstone project for Security Foundations

Security review of the Partner app

Mangrove's leadership wants to know how exposed the Partner app and its 1,800 partner shops are before the busy festival season. About 62% of partner orders are placed in the app and the rest by phone to about 40 sales reps; invoices are paid in the app; the app is built and supported by an outside agency, Lagoon Digital. Produce a short security review that a non-specialist managing director can act on: what matters, who would attack it and how, the top ten risks scored for likelihood and impact, and the ten controls to fund first with a 90-day plan.

What you hand in

  1. An asset and threat list: what is worth protecting (with its confidentiality, integrity or availability need) and who would attack it
  2. A risk register with the top ten risks, each with likelihood, impact, score, owner and treatment
  3. A prioritised control plan: ten controls with rough cost, the risks each one reduces, and a 90-day plan
  4. A one-page summary for the managing director in plain language

Check your work

Tick each item when your project meets it. Be strict: this is the rubric the reviewer uses.

  • Assets are specific to the Partner app (invoices, payment details, partner accounts, sales rep logins, Lagoon Digital's access) and each names the property that matters
  • Risks combine likelihood and impact on a stated scale, and the ranking follows from the scores or explains any override
  • Attack paths are realistic and include phishing of staff or partners, credential stuffing on partner accounts and payment or invoice fraud
  • Every control maps to the specific risks it reduces, and identity controls such as MFA come with a recovery and support plan
  • The plan is realistic for a small team and budget, with owners and dates, and names what is accepted for now
  • The summary works for non-specialists: no unexplained jargon, a clear ask and the effect of not acting

0 of 6 checked

Model answer

The model answer opens once your capstone passes the review, so you can compare your work with an outline of a strong submission.

Hand in your capstone

Your links are checked automatically, then the work is scored against the rubric above, item by item, with comments. A pass counts toward the course certificate and shows on your profile.

Loading…