Chapter 40 — Thesis and presentation
Lesson map
Lesson 40 published. Map, example, EX118.
flowchart TD
N0["Learning outcomes"]
N1["40.1 Thesis structure"]
N2["40.2 Connections"]
N3["40.3 Presentation"]
N4["40.4 Questions"]
N5["40.5 Reflection"]
N6["40.6 Next steps"]
N7["Writing the thesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX118"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["40.1 Thesis structure"]
N2["40.2 Connections"]
N3["40.3 Presentation"]
N4["40.4 Questions"]
N5["40.5 Reflection"]
N6["40.6 Next steps"]
N7["Writing the thesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]
[Learning outcomes]
|
v
[40.1 Thesis structure]
|
v
[40.2 Connections]
|
v
[40.3 Presentation]
|
v
[40.4 Questions]
|
v
[40.5 Reflection]
|
v
[40.6 Next steps]
|
v
[Writing the thesis]
|
v
[Worked example] --> [Exercise EX118]
Learning outcomes
You will (1) write a bachelor's thesis on the capstone; (2) connect it to standards and literature; (3) present to examiners and practitioners; (4) reflect on the four-year journey.
40.1 Thesis structure
Introduction (CampusEats incidents), background (OWASP, SSDF, SLSA, SBOM, literature), method (template design and pilot), results, discussion, limitations, conclusion.
Each chapter answers one question and points to evidence: lab records, release verification reports, trial data and survey results. Lena drafts the method and results first, since they are the most concrete, and writes the introduction last, when she knows exactly what the thesis shows. Synthetic data from the reproducibility package is labelled clearly in figures and captions. Grace reviews the outline before drafting begins.
40.2 Connections
The template implements SSDF practices across all four groups and SLSA build provenance; its tests draw on ASVS. The discussion relates findings to Johnson et al. (2013) on tool adoption: the template worked because it made secure defaults easy.
The discussion also notes where the template goes beyond what the frameworks require and where it falls short, such as not reaching the highest SLSA level. Lena maps each check in the template to the practice or requirement it supports, in a table in an appendix, so examiners can see the connections without searching the text.
40.3 Presentation
Fifteen minutes to examiners, Grace and student project leads: the problem, the template, results, limits and handover.
Lena prepares two versions: a technical talk for examiners and a shorter one for project leads that focuses on setup and benefits. She rehearses with society members and cuts slides that need long explanation. Evidence for each claim is kept in backup slides, ready for questions. Project leads receive the README and setup guide after the talk, so they can try the template themselves.
40.4 Questions
"Would this work for larger projects?" Lena explains it would need customisation and stronger review processes, and suggests a study.
She explains that larger projects have more dependencies, more contributors and often their own CI rules, so the template would serve as a starting point rather than a finished setup. The suggested study would compare setup effort and outcomes in projects of different sizes. Examiners also ask about the small sample, and Lena points to the limits stated in her evaluation rather than defending the numbers beyond what they show.
40.5 Reflection
From logic statements about access rules in year one to a template used by five projects, Lena sees security as a habit built into everyday tools.
The token leak and the hash mismatch from her first month run through the whole thesis: one showed what happens without good habits, the other what happens when a simple check is respected. Lena's main conclusion is that controls work best when they are easy, explained and owned by someone. She keeps her first-year notes.
40.6 Next steps
Lena plans a master's degree and continues to maintain the template as a volunteer.
She hands her CampusEats roles to newer members with the same care she applied to the template, reviewing access and updating the owner lists. Her final log entry lists what she would do differently, starting with measuring sooner, and the open questions she leaves for the next student. The society keeps her decision records, so later members can understand why CampusEats works the way it does.
Writing the thesis
Lena drafts the thesis over ten weeks, sharing chapters with her supervisor. She keeps a claims table linking each statement to evidence and checks every citation against its source. Grace checks that the descriptions of CampusEats and other projects reveal no sensitive details. The final thesis is shorter than the first draft, because unsupported or repeated points were removed.
Thanks and credit
The thesis credits the society, Grace and pilot teams.
Archive
The final thesis is deposited in the university library.
Worked example
Examiners award a first-class mark and ask Lena to share the template beyond the university. With Grace's approval, it is published under an open licence with all examples synthetic.
Synthetic case. The thesis and presentation are synthetic.
Errors and limits
A thesis records what was learned; keep updating practice as tools and threats change.
Exercises
- EX118 — SSDF link. How does the template relate to the SSDF? Rubric: 3 = implements practices across all four groups; 2 = partial; 1 = vague; 0 = none.
- EX119 — Larger projects. How did Lena answer the larger-projects question? Rubric: 3 = customisation, stronger review; study; 2 = partial; 1 = vague; 0 = none.
- EX120 — Publication. How was the template shared? Rubric: 3 = open licence; synthetic examples; Grace's approval; 2 = partial; 1 = vague; 0 = none.
Synthesis
Secure habits built into tools and shared openly are a lasting contribution.
Continue studying — chapter 40 of 40
← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →