🇳🇱 This minor is taught in Dutch only. This English version explains the programme for international readers and partners — the course itself runs entirely in Dutch.
Avans HogeschoolSecure by DesignMinor · Avans
Secure by Design · Phase 3 · talking poster

The Cybersecurity project

The company project starts alongside your profile in week 5, with intensive project work from week 11. In phase 3 you and a team of four or five solve a real cybersecurity problem for a company. The questions differ enormously — a pentest, a NIS2 advisory, a detection solution, an awareness programme — but the route underneath is universal. This poster is that route: an approach that fits any kind of cyber question, with markers showing where you decide the approach yourselves.

phase 3 · continuing weeks 5–19team of 4–5a real company as clientany kind of cyber questionuniversal routeproject planchoices justified

01 Why a cyber project runs differently

A cyber problem is not an ordinary software project. These differences shape your approach — don’t underestimate them.

A1Mandate before action

You need explicit permission, scope and rules of engagement before you touch anything. Without a mandate, testing is simply a criminal offence — this is not a formality.

A2Risk-driven, not feature-driven

You work from threat, risk and compliance, not from user stories. The compass is likelihood × impact, not a feature list.

A3Confidentiality is critical

You touch sensitive systems and data. Secrecy, secure storage and clean-up are part of the work from day one.

A4Evidence must hold up

Findings are reproducible and substantiated. You record what you did so someone else can retrace it — auditable, not ‘trust me’.

A5Not just straight into production

You test in a safe environment or strictly controlled and in consultation. You may not damage or take anything down.

A6Success = risk reduced

It is not ‘does the feature work’, but ‘is the organisation demonstrably safer’ or ‘has the question been answered with evidence’.

A7Handover counts too

The organisation must be able to carry on after you. Advice, a playbook or knowledge transfer is part of the result — not ‘done, good luck’.

02 The roadmap — a universal project approach

The content differs per question, the route does not · click a phase open · ◆ = this is where you make choices

0
Activiteiten
  • Intake conversation: sharpen the assignment, expectations and context
  • Determine which type of problem this is
  • Agreements on scope, mandate/permission, confidentiality (NDA) and data handling
  • Record rules of engagement, point of contact and escalation line
Anders dan software bouwenWithout explicit permission and a delineated scope you may do nothing. This is a legal and ethical precondition to start.
◆ Keuzes hierWhich type of assignment is it — assessment, advisory, build, test, detection or awareness? That choice steers everything that follows.
Opbrengst: Signed agreements, a clear assignment and clear lines of contact.
Wie trekt: The project lead drives it; the whole team reads along and understands the boundaries.
1
Activiteiten
  • Map assets, stakeholders and the current situation
  • Explore relevant threats and compliance requirements
  • Reformulate the central question into something researchable
  • Define success criteria and an initial risk estimate
Anders dan software bouwenYou map assets, threats and risk appetite instead of functional requirements — the question behind the question.
◆ Keuzes hierNarrow & deep or broad & high-level? And which framework becomes your anchor: NIST, ISO, OWASP, CIS or something sector-specific?
Opbrengst: A sharp problem definition, scope and measurable success criteria.
Wie trekt: Content lead + client contact.
2
Activiteiten
  • Choose and justify the approach and method
  • Planning, milestones and role division
  • Name deliverables, risks and assumptions
  • Work out ethics, data handling and rules of engagement; for testing also responsible disclosure
Anders dan software bouwenThe plan explicitly includes safety (break nothing), data handling and a fallback plan — parts a software plan often misses.
◆ Keuzes hierMethod (black/grey/white box, qualitative vs quantitative risk, phased vs iterative), environment (lab vs controlled production), and tooling (build your own vs existing).
Opbrengst: An approved project plan that the client has seen.
Wie trekt: The whole team; the project lead guards feasibility and planning.
3
Activiteiten
  • Iterate in short cycles with regular check-ins
  • Record what you do and what you find
  • Coordinate with the client for anything touching live systems
  • Check along the way whether you are still answering the question
Anders dan software bouwenWork reproducibly and logged. If you touch sensitive systems, do so only in consultation and controlled — improvising can cause damage and liability.
◆ Keuzes hierDepth per finding, steering on time (time-boxed) or on coverage, and how much you automate.
Opbrengst: Substantiated findings or a working (partial) product, with evidence.
Wie trekt: Specialists out front; documentation/quality records the evidence.
4
Activiteiten
  • Weigh risks on likelihood × impact
  • Prioritise and cluster findings
  • Weigh feasibility and trade-offs for this organisation
  • Draw up recommendations and a roadmap for the client
Anders dan software bouwenYou deliver not a bare list of findings, but prioritised and actionable advice that fits the organisation’s risk appetite and resources.
◆ Keuzes hierPrioritisation method (risk matrix, CVSS, business impact) and how far you advise: quick wins or a strategic line.
Opbrengst: Prioritised recommendations with substantiation.
Wie trekt: Content lead + project lead.
5
Activiteiten
  • Deliver the end product: report, prototype, policy, playbook or training
  • Presentation to the client
  • Knowledge transfer and — where needed — responsible disclosure
  • Return or delete sensitive data properly, revoke access
Anders dan software bouwenHandover and safely settling data and access are part of delivery. In cyber the project does not stop at ‘delivered’.
◆ Keuzes hierDelivery form and the degree of handover: advise only, or help set up/implement.
Opbrengst: A delivered and handed-over result with the client’s sign-off.
Wie trekt: Communication/presentation out front; the whole team presents.
6
Activiteiten
  • Evaluate process, collaboration and result
  • Individual reflection
  • Formal closure with the client
  • Verify that all access and data copies have been cleaned up
Anders dan software bouwen‘Closing’ in cyber also means demonstrably revoking all access and deleting copies of client data.
Opbrengst: An evaluation and a tidy, accountable closure.
Wie trekt: The whole team.

03 Learning programme · weeks 5–19

The project starts in week 5 alongside your profile. Week 11 marks the move to four project days and one teaching/support day per week, not a new start. Existing project stages continue and may overlap. Week 19 follows the final-event schedule.

  • Weeks 5–6: form teams, prepare and conduct intake; establish the assignment, mandate and problem understanding.
  • Weeks 7–8: develop the approach, conduct initial research and try a direction using client feedback.
  • Weeks 9–10: investigate and develop, review early results and plan next steps. This provides evidence for Business Understanding in week 11.
  • Weekly tutor contact: within the feedback block in weeks 5–10; from week 11, a 30–45 minute team meeting on the teaching day. The midterm replaces that week’s regular meeting.
  • Bring visible work, feedback and a specific question. Discuss mandate, data management, risks, evidence and teamwork; finish with actions. Profile development and the portfolio continue.
  • Prefer client delivery in week 18, no later than Monday week 19. Thursday week 19: final event. Week 20: resits and remedial work.
Shared start and timetable · weeks 5–10 →Final event programme · week 19 →
Week 11

Business Understanding

Revisit context, scope & approach
Teaching
Business Understanding afternoon
Lessons & clinics
Core
Show the real assignment emerging from work in weeks 5–10.
Activity
Present business context, problem, value, evidence, assumptions and questions. Six teams: 13:00 opening; 13:15 three 25-minute slots; 14:30 break; 14:45 three slots; 16:00–16:30 process feedback.
Output
Refined assignment and follow-up client questions.
4 days
Project work
Company project
Core
Revisit context, scope & approach
Activity
Check peer feedback with the client and update the ongoing approach.
Output
Updated plan and results within confirmed scope.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 12

Evidence & validation

Execute & investigate
Teaching
Evidence & validation workshop
Lessons & clinics
Core
Demonstrate how you answer your research question.
Activity
Work on source quality, reproducibility, test criteria and limitations using your own project.
Output
Validation plan and evidence agreements.
4 days
Project work
Company project
Core
Execute & investigate
Activity
Investigate, build or test and gather evidence according to your plan.
Output
Traceable findings or a tested partial product.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 13

Collaborate & adjust

Execute & investigate
Teaching
Peer consultation on real situations
Lessons & clinics
Core
Keep expectations and delivery aligned.
Activity
Discuss scope changes, dependencies and difficult coordination; practise a client conversation.
Output
Actions addressing a specific collaboration issue.
4 days
Project work
Company project
Core
Execute & investigate
Activity
Continue work, agree changes and prepare visible midterm results.
Output
Interim results, client feedback and review questions.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 14

Midterm review

Review execution & adjust
Teaching
Midterm with client feedback
Lessons & clinics
Core
Assess quality, direction and feasibility while changes remain possible.
Activity
Demonstrate initial results and evidence; discuss risks and planning. Invite the client or collect focused feedback beforehand.
Output
Review record and prioritised plan for the second half.
4 days
Project work
Company project
Core
Review execution & adjust
Activity
Process the review and investigate or test key improvements.
Output
Improved results and feasible schedule.
Week 15

Analyse & advise

Analyse, prioritise & advise
Teaching
From finding to advice
Lessons & clinics
Core
Make results useful for business decisions.
Activity
Weigh risk and business impact, compare feasibility and justify trade-offs.
Output
Prioritised recommendations with evidence and limitations.
4 days
Project work
Company project
Core
Analyse, prioritise & advise
Activity
Continue analysis, check recommendations with the client and fill evidence gaps.
Output
Draft advice or improved product with justification.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 16

Transfer knowledge

Prepare handover
Teaching
Knowledge transfer workshop
Lessons & clinics
Core
Enable recipients to continue independently.
Activity
Identify audience and learning goal; practise explanation, let a peer try a task and check understanding. Apply this to client handover and a profile workshop.
Output
Handover outline and a tested workshop exercise.
4 days
Project work
Company project
Core
Prepare handover
Activity
Develop the product and documentation; agree what the client needs for independent use.
Output
Draft handover package and delivery agreements.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 17

Validate & finish

Advice → delivery
Teaching
Peer review of draft deliverables
Lessons & clinics
Core
Check results and advice against success criteria.
Activity
Review products, conclusions, evidence, limitations and handover materials; prioritise improvements.
Output
Review findings and a bounded improvement list.
4 days
Project work
Company project
Core
Advice → delivery
Activity
Complete validation and improvements; confirm client delivery arrangements.
Output
Validated final draft and delivery arrangements.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 18

Deliver to the company

Deliver & hand over
Teaching
Client delivery & presentation coaching
Lessons & clinics
Core
Hand results to the people who will use them.
Activity
Present and demonstrate to the company, transfer knowledge and record feedback and next steps. Rehearse the final-event story on the teaching day.
Output
Handed-over result, client feedback and draft presentation.
4 days
Project work
Company project
Core
Deliver & hand over
Activity
Process feedback, complete documentation and prepare the project stand and profile workshop.
Output
Delivery package and event materials. Fallback delivery slot: no later than Monday of week 19.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.
Week 19

Final event & closure

Share, reflect & close
Teaching
Dress rehearsal & final event
Lessons & clinics
Core
Share project results and individual expertise.
Activity
Monday–Wednesday: finish work, rehearse workshops and keynotes, and test demos. Thursday: morning workshops; keynotes and all six project presentations from 14:00.
Output
Project presentation, profile workshop and shared results.
Close
Reflection & closure
Company project
Core
Share, reflect & close
Activity
Friday: evaluate collaboration and development; close with the client and check access and client-data agreements.
Output
Reflection and closure check; specific resit or remedial actions for week 20 if needed.
Tutor
Weekly progress & feedback
Tutor meeting
Core
Define your next step and keep developing your expertise.
Activity
Discuss visible work, client feedback, a specific question and profile development. Check planning and ongoing tracks.
Output
Recorded decisions, feedback and actions for the team and individual development.

04 Continuous tracks

In a cyber project these are not separate phases but lines that run the entire journey. Neglect one and the project stalls — or worse.

runs through every phase

Ethics & law

Stay within the law and your mandate: permission, GDPR, no harm. In doubt? Coordinate first, don’t act.

Confidentiality & data handling

Secure storage, secrecy, and clean-up at the end. Treat client data as if it were your own secrets.

Stakeholders & communication

Manage expectations and coordinate regularly. No surprises for the client — a cyber project is political too.

Risk-driven working

Tie everything back to likelihood × impact and the original question. That keeps you away from fun-but-irrelevant side paths.

Evidence & reproducibility

Record, substantiate, make traceable. A finding without evidence is an opinion.

Team process & role division

Tasks, planning, quality and roles that may rotate. A good process carries the substantive work.

05 Decision points — where you set your own approach

The route is fixed, but at these points the team chooses deliberately. Justify every choice in your project plan — that is where the professional judgement lies.

F1Type of assignment

assessmentadvisorybuild / prototypetest / pentestdetection & responseawareness

F2Framing

risk-drivencompliance-drivencombination

F3Framework as anchor

NIST CSFISO 27001OWASPCIS Controlssector-specific

F4Scope

narrow & deepbroad & high-level

F5Research / test form

black boxgrey boxwhite boxqualitative riskquantitative risk

F6Environment

lab / test environmentcontrolled production

F7Building

build your ownexisting tooling

F8Process

phased (waterfall-like)iterative / agile

F9Delivery form

reportprototypepolicy / playbooktrainingcombination

F10Handover

advice onlyhelp set up / implement

06 Team & project plan

Roles in a team of 4–5

With four people you combine roles. Feel free to rotate them per phase.

Project lead / client contact

Planning, stakeholders and scope control. The single face towards the client.

Content lead (researcher / architect)

Guards the substantive depth and direction of the work.

Specialist(s)

Technical or governance, depending on the problem — the executing force.

Documentation & quality

Guards evidence, substantiation and traceability. The ‘evidence keeper’.

Communication & presentation

Reporting, final presentation and the throughline of the story.

In your project plan

The backbone of phase 2 stays in place, with cyber-specific additions (mandate, law, data handling).

  • Rationale & context (client and question)
  • Objective and problem statement + research question
  • Scope & delineation — including what is out of scope
  • Mandate, permission & rules of engagement
  • Ethics, law (GDPR) & data handling
  • Approach & method, with justified choices
  • Planning & milestones
  • Role division within the team
  • Deliverables & success criteria
  • Risks, assumptions & fallback plan
  • Communication & coordination agreements
Phase 3 talking poster — The Cybersecurity project · builds on the Secure-by-Design basis and the Professional Profile.Click a phase open · watch the ◆ decision points.
Minor Secure by Design · Avans University of Applied Sciences — security as a design quality.Contact · Partners