Frontiers capstone: brief the board on what changed

The exercise is one page for a board. Not a technical audience: a group that decides money and dates, reads for ten minutes, and remembers whatever you gave them a reason to act on. The only rule is that nothing goes on the page unless you can say where it came from, how it was measured and when. Everything else about the exercise is straightforward. The rule is what makes it work.

Boards do not read topics, they read positions, so the unit of the page is not a protocol name. It is four sentences: what changed, which date binds us, where we stand today, and what we do next. A statement that survives all four is a position somebody can approve or refuse. A statement that survives only the first is news, and news does not need a board meeting.

Here is the page, written from what this course has taught, with each entry cut to the length a director will actually read.

Transport. The web has moved off plain TCP for a large share of its traffic. QUIC carried roughly 21 to 35 percent of traffic on Cloudflare Radar depending on the window and the method, and about 39 percent of websites advertised HTTP/3 support on W3Techs, both measured on 13 July 2026. What follows for us: HTTP/3 runs over UDP port 443, so a firewall rule that blocks UDP 443 quietly downgrades our own users to TCP and reports nothing. Next step, a named owner checks that rule this quarter.

Addressing. IPv6is no longer a future item. Google measured 50.10 percent of its worldwide users arriving over IPv6 on 28 March 2026, and APNIC Labs, measuring capability rather than arrivals, puts the worldwide figure at 42 to 43 percent with India and France above 70 percent. What follows for us: any service we run that is IPv4-only reaches a growing share of its users through somebody else's translation equipment. Next step, one segment gets an IPv6 twin this year and we measure what breaks.

Certificates. The renewal cycle we built our processes around is being withdrawn on a schedule. CA/Browser Forum ballot SC-081v3, approved on 11 April 2025, cuts the maximum validity of a public TLS certificate to 200 days from 15 March 2026, 100 days from March 2027 and 47 days from March 2029. What follows for us: any certificate a person renews by hand becomes a scheduled outage. Next step, every public certificate gets named alongside the system that renews it, by a date.

Remote access. The default shape of remote access has changed. More than 70 percent of new remote-access deployments choose zero trust network access over a virtual private network, because a VPN grants reachability to a network while the newer model authorises one named application at a time. What follows for us: our own VPN grants far more than any single user needs. Next step, one application moves behind per-application authorisation and we learn what that costs.

Transport security. The protection on our encrypted traffic is being rebuilt underneath us and most of it has already happened: hybrid post-quantum key exchange has been on by default in Chrome since version 124 in April 2024 and in Firefox 132, and it was negotiated in more than 30 percent of TLS 1.3 handshakes at Cloudflare's edge in early 2026. The date that binds the rest is NIST IR 8547: classical public-key cryptography deprecated after 2030 and disallowed after 2035. What follows for us: anything confidential with a long shelf life is the part that matters. Next step, we inventory long-lived secrets before we buy anything.

Five entries, twenty sentences, one page. Notice what the rule removed. "Networks are more complex than ever" has no source, no date and no decision attached, so it is not a position. "Artificial intelligence is changing networking" cannot be defended until somebody says which claim, measured by whom. A vendor percentage with no observatory behind it is a number-shaped opinion. Cutting those three is not modesty. It is what leaves room for the five entries that can be defended, and it is the habit this course has been calling measurement literacy since the foundations stage: source, method, population, date, every time.

One more thing the page has to carry, and it is the part people leave out. A date on a measurement is not a date that binds you, and the page has to say which kind it is showing. Two entries above carry a deadline somebody else set, certificates and transport security. The addressing and transport entries carry a measurement and no deadline, and the remote-access entry carries no date of either kind, because no standards body or browser vendor has published one. Saying which is which is what makes the two deadlines land, because it shows the page is reporting rather than selling.

A page like that survives a calm room. The two exercises that follow are what happens when the room stops being calm, and they test different halves of it. The first tests whether you can produce evidence at the speed an incident moves.

At 09:12 the checkout page starts taking seconds instead of milliseconds for some users, not all. Error rates climb over the next ten minutes. Your edge provider reports a request flood against your domain. The executive call is at 09:45, and between now and then somebody will ask what is happening and what you are doing about it.

The decision board above is the discipline for that half hour. It reads top to bottom as four lanes, one per layer, and each lane owes the incident the evidence only that layer can produce. Each lane ends at a gate with the same question in different clothes: does this layer's evidence account for the delay users are feeling? If it does, the pass route names what to do. If it does not, the fail route escalates to the next lane carrying what has been ruled out. Nothing on that board lets you skip a lane because you already have a theory.

The case behind this tabletop is documented and worth knowing exactly. In October 2023, HTTP/2 Rapid Resetwas disclosed jointly by Google, Cloudflare and Amazon Web Services as CVE-2023-44487. The technique abuses a feature that exists for the client's benefit: stream cancellation, which lets a browser abandon a request it no longer needs. An attacker opens a stream, cancels it immediately, and repeats, so the server keeps starting work it never has to finish while the connection stays inside its concurrency limit. Google mitigated 398 million requests per second, Cloudflare 201 million and Amazon Web Services 155 million. This is the shape of a modern distributed denial of service event: not a bug in the protocol, but a promise the protocol made being cashed at a rate nobody costed.

Now walk the lanes with that incident in front of you, because the value of the board is what it makes you collect before you speak.

Link. Interface counters, error rates, wireless retries and roaming. In a request flood these are almost always clean, and clean counters are a finding rather than a dead end: they rule out the layer everybody blames first and they cost two minutes to check. Write down that you checked.

Network. Routes, next hops, and a traceroute read as evidence rather than as proof. The question is whether the path changed when the timing changed. Under anycast mitigation the same address is announced from many places, so a flood entering one region is absorbed near where it lands, and the point of presence serving your users may change while nobody touches your application. That is a timing change with a routing cause, and if you do not look for it you will attribute it to the application.

Transport. Handshakes, retransmissions, round-trip time and UDP 443. This lane matters in a flood because it separates a conversation that cannot start from one that starts and then stalls, and because the UDP 443 question is now a standard check rather than an exotic one.

Application. Server timings, status codes and correlated traces. This is the lane where Rapid Reset actually shows itself, and it shows itself as an odd pair of numbers: concurrency and work started are high, completions are low, and the server is busy producing nothing. A distributed trace is what turns that into a statement you can defend, because it follows one request through every service it touched and shows where the time went. A dashboard showing green averages will not, which is the whole argument of the observability module arriving in a real incident.

Two questions decide what you say next, and they have different answers. Who mitigates is the easy one: volume is absorbed at the edge, by capacity spread across many locations and by mitigation that understands the protocol well enough to tell an abusive stream from a legitimate one. What that does not do is fix your own servers. The organisations that ran the record mitigations still had to patch their own software, and so did everyone else, because the edge protected the path and the vulnerability lived in the implementation.

The harder question is how you report the scale of it, and this is where briefings go wrong. Rapid Reset was measured in requests per second because the cost was work started, not bandwidth consumed. Reported in bits per second it would have looked unremarkable. Requests per second, bits per second and packets per second measure three different kinds of exhaustion, and quoting the wrong one to a board leads to the wrong purchase.

What you say publicly comes last and follows the same rule as the brief. Three sentences: what users are experiencing in their own terms, what you have ruled out, and when you will next update. No cause you have not proved, and no restoration time you do not control. If the honest position at 09:45 is that the link, network and transport lanes are clean and the application lane is still being read, say exactly that. Three ruled-out layers and no answer yet is not a failure of the exercise. It is a narrower next test than you had at 09:12, and saying so out loud is what the board at the top of this page is built to rehearse.

The flood was loud, fast and public, and every lane had something to say within minutes. The second tabletop inverts all three of those properties, and the board still works, because the question it asks each layer changes shape rather than disappearing.

The second exercise starts with no alert. A national authority publishes an advisory describing techniques used against network operators, and one of them matches how your own management network is built. Nothing is slow. No dashboard is red. The question on the table is whether somebody has been inside, and for how long.

The documented case is Salt Typhoon. A state actor attributed to the People's Republic of China was inside major United States telecommunications operators from October 2024. The United States Cybersecurity and Infrastructure Security Agency issued hardening guidance in December 2024, and the joint advisory AA25-239A followed in August 2025. The agency now advises high-risk users to prefer end-to-end encrypted messaging, which is a plain instruction rather than a technical one: if the carrier network is contested ground, protect the content rather than trusting the pipe.

The lesson a network professional should take from it is about the target. The objective was not the traffic of any one customer. It was the management plane: the systems that configure, monitor and mirror the network. Whoever holds those decides where traffic goes and who can see it, without ever touching a packet in flight. In most organisations the management plane is also the least defended part of the estate, because it sits on an internal network everybody agreed years ago to treat as trusted.

Run the same four lanes, with the question changed from "which layer explains the delay" to "which layer can prove nothing was changed". The board still works because it was never about speed, it was about which layer owes which evidence.

Link. Port configuration and, above all, mirror sessions. A port configured to copy traffic somewhere is how a network is watched from the inside, and it leaves a record in a configuration rather than in a graph. The evidence question is whether the ports today match the ports you intended.

Network. Routes and next hops against a known-good state, plus whether your address space is being announced by anyone else. Route Origin Validation is the external half of that check, and it is worth quoting carefully: more than 50 percent of IPv4 routes are now covered by signed records, roughly 480,000 of them, while only about 12 percent of stub autonomous systems are fully protected. Coverage is not protection, and a briefing that reports the first number without the second is overselling.

Transport. Who connected to the management systems, from where, with what credential, and whether both ends proved an identity. Mutual TLS matters here for a reason that is easy to state: if only the server authenticates, the record of who connected is whatever the client claimed. If both ends present a certificate, the record is evidence.

Application. Configuration differences and telemetry gaps. This lane is the one that decides the exercise, and it is decided months before the incident by whether the intended state of the network is written down anywhere a machine can check. Where configuration lives in version control as infrastructure as code, a difference between the intended state and the running state is a fact with a timestamp. Where it lives in an engineer's memory, the same question produces a recollection. The second is not evidence, and a regulator will treat it as absence.

That last point is why a gap in the telemetry is itself a finding. Logs that stop and restart, a device that reported nothing for six hours, a monitoring agent that was disabled and re-enabled: none of those prove an intrusion, and all of them are evidence that has to appear in the note rather than be smoothed over.

The regulator arrives before the log search finishes, and the questions are predictable. When did you know. What did you tell customers, and when. What can you prove about the period before you knew. In the European Union, NIS2 sets the floor for those obligations across medium and large entities in critical sectors, and the reporting clock is short enough that the answers are assembled during the incident rather than after it. The first two questions are answered by your incident record. The third is answered by decisions taken long before, about what you retain and for how long, which is why a tabletop that never asks it is a rehearsal of the easy part.

Both tabletops end at the same place: a written note that names what each layer produced, what was ruled out, and what happens next. The briefing in the first section needs the same discipline pointed at the future rather than at an incident, and that is the difference between a summary of the news and a position.

A migration position is not an opinion about the future. It is a row with four cells: what has already been decided elsewhere, the anchor that binds you to it and whether that anchor carries a date, where you honestly stand today, and the one next step you own. Four rows fit on the page, and they are the four this course has argued for.

Post-quantum transport security. The reason this moves before anyone owns a quantum computer is harvest now, decrypt later: an attacker who records encrypted traffic today needs only storage and patience, so confidentiality has a deadline that runs from the moment the traffic crosses the wire. What deployed in answer is a hybrid key exchange, combining a classical exchange with ML-KEMso that an attacker has to break both. It has been default in Chrome since version 124 in April 2024 and in Firefox 132, and it was negotiated in more than 30 percent of TLS 1.3 handshakes at Cloudflare's edge in early 2026. The dated anchor for the rest is NIST IR 8547: classical public-key cryptography deprecated after 2030 and disallowed after 2035. Status: already default in the browsers, largely invisible to your users. Next step: check what your own stack negotiates, and inventory the secrets whose value outlives 2030.

Certificate lifetimes. This is the row with the nearest date and the least discretion. CA/Browser Forum ballot SC-081v3, approved on 11 April 2025, cuts the maximum validity of a public TLS certificate to 200 days from 15 March 2026, then 100 days from March 2027, then 47 days from March 2029. Nobody is being asked to agree with the schedule: certificate authorities will simply stop issuing longer ones. ACME automation stops being a preference at that point, because a 47-day certificate renewed by a person is a recurring outage waiting for a holiday. Status: dates are set, and the first one has passed. Next step: list every public certificate you hold and name the system that renews it, with a date against each name.

IPv6-mostly segments. The measurement is past halfway on one respected count and short of it on another, and both belong in the position. Google measured 50.10 percent of its worldwide users arriving over IPv6 on 28 March 2026. APNIC Labs, asking whether end users are capable of IPv6 at all, puts the worldwide figure at 42 to 43 percent, with India and France above 70 percent. There is no deadline here, and the pressure is commercial rather than regulatory: running two internets indefinitely costs twice. An IPv6-mostly segment is the mechanism for starting to retire the second one without abandoning the devices that still need it. Status: past halfway on the arrivals measurement, moving, and bound by no published deadline. Next step: draw the IPv6 twin of one IPv4 segment you own this year, and find out what breaks while it is cheap to find out.

Zero trust access in place of the VPN. More than 70 percent of new remote-access deployments now choose per-application authorisation over a network-level tunnel, and NIST SP 800-207 gives the model its shape. What it does not give is a date, and the row has to say that. Nothing obliges you to retire the VPN this year, which means this position is adoption-led: you are choosing to follow where the market has already gone, for reasons you can state, on a timetable you set. Status: no published deadline. Next step: move one application behind per-application authorisation this quarter and measure what it costs before promising the estate.

Read the four rows together and the shape of the page appears. Two carry a deadline somebody else published and two do not, and the honest labelling of the undated pair is what makes the dated pair credible. A board that has been told "this one is set by a standards body and this one is our choice" can allocate attention correctly. A board given four rows of equal urgency will discount all four.

Every one of those rows contains a number, and a number is the part of a briefing that gets challenged. Producing the page is the easy half. Holding it in the room is the skill the course has been building towards.

Challenges to a briefing arrive in four forms, and each has a different correct answer. Where did that come from is a challenge to the source. How was it counted is a challenge to the method. Who exactly was counted is a challenge to the population. And how old is it is a challenge to the date. Prepare all four for every number on the page and the room stops being frightening, because the answers are short.

Work through the ones you will actually get. "QUIC is most of the internet now, isn't it?" The answer is two measurements rather than one: roughly 21 to 35 percent of traffic on Cloudflare Radar, depending on the window and the method, and about 39 percent of websites advertising HTTP/3 on W3Techs, both measured on 13 July 2026. One counts traffic crossing a single very large network. The other counts sites that say they support it. Neither is wrong, and neither answers the other's question. A brief that quotes one and hides the other has taken a side in an argument it did not disclose.

"Has routing been fixed yet?" More than 50 percent of IPv4 routes are covered by a signed Route Origin Authorisation, roughly 480,000 records in all, and about 12 percent of stub autonomous systems are fully protected. Those two figures measure different things, and the gap between them is the answer to the question. Something real has been done, and the work is visibly unfinished. That is a more useful sentence for a board than either number alone.

"Our supplier says they support the latest multipath standard." Multipath QUIC is an Internet-Draft, draft-ietf-quic-multipath, not an RFC. Shipping a feature is an implementation decision, not publication, and the same caution applies to several things this course has taught as real and deployed: BBRv3 is draft-ietf-ccwg-bbr, Happy Eyeballs version 3 is draft-ietf-happy-happyeyeballs-v3, and the hybrid key exchange group X25519MLKEM768 that Chrome turned on by default is draft-ietf-tls-ecdhe-mlkem. All four are drafts. Calling any of them an RFC in a document that will be read by a supplier, an auditor or a regulator is the kind of small error that costs you the rest of the page.

The date challenge is the one people take personally, and it should be the easiest. TLS 1.3 was republished in July 2026 as RFC 9846, which obsoletes RFC 8446 while leaving the protocol version unchanged. A citation to RFC 8446 is not wrong about the protocol, but it is out of date about the document, and the difference between those two statements is exactly what a challenger is testing. Know which of your citations have been superseded, and say so before somebody else does.

Then there is the challenge with no good answer, which is the one worth rehearsing most. When you do not know, the professional response is the same shape as the close of a tabletop: here is what I checked, here is what it ruled out, here is the one next test, and here is when you will hear from me. An unresolved question with the ground narrowed and the next test named is a result. A confident answer with nothing behind it is the only genuine failure available in this exercise, and it is the one that ends careers quietly, a year later, when somebody finds the slide.

The check below is that room in miniature. Three challenges of the kind that arrive when a brief meets an audience, and in each case the task is to be accurate rather than reassuring.