Chapter 4 — Academic writing
Lesson map
Lesson 04 published. Map, example, EX010.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Structure"]
N2["4.2 Evidence"]
N3["4.3 Accurate citation"]
N4["4.4 Responsible detail"]
N5["4.5 Clarity"]
N6["4.6 Feedback"]
N7["Sources to read"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX010"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Structure"]
N2["4.2 Evidence"]
N3["4.3 Accurate citation"]
N4["4.4 Responsible detail"]
N5["4.5 Clarity"]
N6["4.6 Feedback"]
N7["Sources to read"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX010"]
[Learning outcomes]
|
v
[4.1 Structure]
|
v
[4.2 Evidence]
|
v
[4.3 Accurate citation]
|
v
[4.4 Responsible detail]
|
v
[4.5 Clarity]
|
v
[4.6 Feedback]
|
v
[Sources to read]
|
v
[Worked example] --> [Exercise EX010]
Learning outcomes
You will (1) write clear, evidence-based academic text on security topics; (2) cite sources accurately; (3) structure arguments; (4) avoid publishing harmful detail.
4.1 Structure
An academic essay states a question, reviews evidence, argues and concludes. Lena's first essay asks: "Why do secrets leak into source repositories?"
She narrows it to student projects like CampusEats, plans one part of the argument per cause, and drafts the conclusion first so that every paragraph has a clear job. The essay has a word limit, so each paragraph must earn its place by supporting the answer. Each paragraph opens with its claim and then gives the evidence for it.
4.2 Evidence
She cites the OWASP Top 10:2021 for categories of failure and NIST SP 800-218 (SSDF) practice PS.1 on protecting code from unauthorised access and tampering. She uses the CampusEats incident as a case, with permission and without the token value.
Each source is chosen for a different purpose: OWASP for the categories, the SSDF for the expected practice and the incident for a concrete example. She notes the limits of each, such as the incident being a single case. She also avoids claims she cannot support, such as how often leaks happen nationally.
4.3 Accurate citation
Every claim with a source has a citation with author, year and title; quotations are marked. Lena checks each reference against the original.
She keeps a reference list as she reads, not afterwards, and records where each claim came from. A citation that cannot be traced is removed rather than guessed. When she paraphrases, she checks that the meaning matches the source, since a careless paraphrase can change a cautious claim into a strong one. Grace treats a wrong citation as seriously as a wrong fact.
4.4 Responsible detail
Security writing describes weaknesses, effects and fixes, not instructions for misuse. Lena's essay explains why the token was dangerous without describing how anyone could use it.
The same applies to the hash mismatch: she describes what the check protected and why the build stopped, not how a tampered package could be made. Readers learn enough to fix the problem and recognise it elsewhere, which is the purpose of the essay. Grace reviews any security essay that uses CampusEats details before it is shared outside the course.
4.5 Clarity
Short sentences, defined terms, one idea per paragraph.
Lena rewrites her longest paragraph into three shorter ones and defines "token" and "hash" the first time they appear. She reads the essay aloud to find sentences that are hard to follow. A reader outside security, such as a café manager, should be able to understand the main argument. Clarity is not simplification: the technical points stay, but each is stated once, in plain words, where it is needed. She keeps a short glossary.
4.6 Feedback
Grace comments that the essay's best paragraph is the one explaining why "test keys" are still dangerous: they often share infrastructure with live systems.
Grace also asks Lena to cut a paragraph on general password advice that does not answer the question. Lena revises, keeps a record of the changes and notes which comments she disagreed with and why. Feedback is most useful when it changes the next draft, so she schedules the revision within a week. She also asks a classmate to read it.
Sources to read
Lena keeps a reading list of standards and papers with notes on each, so she can find and cite them later. She separates standards, which define practice, from research papers, which give evidence, and notes which claims each can support.
Plagiarism and AI tools
All wording must be the student's own or quoted with a citation. If writing tools are used, the university's rules on declaring them apply, and every citation they suggest must be checked against the real source.
Worked example
Lena's tutor asks her to support the claim "most leaked secrets are found within hours" with evidence. She cannot find a reliable source and rewrites it as "in our case, the secret was found within two hours", which the evidence supports.
Synthetic case. The essay and feedback are synthetic.
Errors and limits
Citing a source you have not read is a serious error; read before citing.
Exercises
- EX010 — Essay question. What was Lena's essay question? Rubric: 3 = why secrets leak into repositories; 2 = partial; 1 = vague; 0 = none.
- EX011 — Unsupported claim. How was the unsupported claim fixed? Rubric: 3 = narrowed to "in our case, within two hours"; 2 = partial; 1 = vague; 0 = none.
- EX012 — Test keys. Why are test keys still dangerous? Rubric: 3 = share infrastructure with live systems; 2 = partial; 1 = vague; 0 = none.
Synthesis
Write clear, cited arguments that explain without enabling harm.
Continue studying — chapter 04 of 40
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →