This Week: Final Project Demonstrations (RAP2)

• No lecture; final report (the complete guide) + protected application + test results
• RAP2 = 70% of the final · Quiz-2 = 30% · Course grade = 0.4·Grade_Midterm + 0.6·Grade_Final
• Detailed rubric: project guide · order and timing: in class
• ⚠️ No late submissions · a finding–action list for the midterm feedback

Security Guide Map S0–S17 — Diagram

RAP2 Submission — Diagram

Suggested Demonstration Flow

1. Summary: product, architecture, the three most critical assets
2. Since the midterm: finding–action list
3. Live demonstration: cryptography, secure communication, a protection layer working live
4. Evidence: tests, protection table, SBOM, compliance matrix
5. Remaining risk: what was deliberately scoped out, and why

Final Demonstration — Diagram

Sample Questions

• Which key is this key derived from, where does it live, when is it deleted?
• Where are chain and hostname verification performed?
• What happens if signature verification fails? Can an old but validly signed version still be installed?
• Did you measure the cost of obfuscation?
• Where is the evidence for this row marked "met"?
• Which requirement did you defer, and how will the other party meet it?

S16: Results, Not a Plan — Diagram

At the End of the Term

• Your guide = a small model of certification documents → portfolio (make sure it contains no confidential information)
• Every submitted line must be explainable; any team member may be asked a question

Final Exam Period

Week 16 — Quiz-2

• Scope: weeks 9–14
• Study guide: Week 16 page

What Does the Final Measure?

The final demonstration measures the entirety of your project:

• cryptography, secure communication
• asset management (complete)
• advanced binary protections
• test results, standards

Item · Cryptography

• Algorithm inventory, key lifecycle.
• Evidence: S8 + tests.

Item · Secure Communication

• TLS, pinning, message level.
• Evidence: S6, S11 + tests.

Item · Advanced Binary Protections

• Obfuscation (S9 advanced), build pipeline (S15).
• Evidence: measurement table + signing.

Item · Testing and Verification

• Test results (not a plan).
• Evidence: S16.

Item · Standards and Compliance

• Compliance matrix (S17), deferred requirements (S14).
• Evidence: S14, S17.

New Sections

• S6 identity/binding
• S8 cryptography/keys
• S11 secure communication
• S14 assumptions/deferred requirements
• S15 build/deployment pipeline

To Be Completed

• S5 assets (complete)
• S9 hardening (advanced)
• S12 reporting (complete)
• S16 results
• S17 complete matrix

Finding–Action (from the Midterm)

• Midterm feedback into one table:
  • finding → action → closure.
• The assessor looks for this loop.

Flow · Summary + Since the Midterm

• Product, architecture, the three most critical assets.
• Finding–action list.

Flow · Live Demonstration

• Cryptography, secure communication and a protection layer working live.
• E.g., a tampered file being rejected.

Flow · Evidence + Remaining Risk

• Tests, protection table, SBOM, compliance matrix.
• Remaining risk: what was deliberately scoped out.

Question 1

Which key is this key derived from, where does it live, when is it deleted?

Question 2

Where is certificate chain and hostname verification performed?

Question 3

What happens if signature verification fails? Can an old but validly signed version still be installed?

Question 4

Did you measure the cost of obfuscation? Which function did you obfuscate, and why?

Question 5

Where is the evidence for this row marked "met" in the compliance matrix?

Mistake List

• Test plan exists, no results.
• "Met" without evidence.
• Guide and code version differ.
• Remaining risk is empty.
• Midterm feedback was ignored.
• Real secret/personal data in the repo.

Final Word (RAP2)

At the final, results are expected: every protection is shown working, every requirement is tied to evidence.

Your guide is a small model of certification documents; it is a portfolio item.