Chapter 40 — Thesis and presentation
Lesson map
Lesson 40 published. Map, example, EX118.
flowchart TD
N0["Learning outcomes"]
N1["40.1 Structure"]
N2["40.2 Argument"]
N3["40.3 Presentation"]
N4["40.4 Questions"]
N5["40.5 Reflection"]
N6["40.6 Outcome"]
N7["Preparing the talk"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX118"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["40.1 Structure"]
N2["40.2 Argument"]
N3["40.3 Presentation"]
N4["40.4 Questions"]
N5["40.5 Reflection"]
N6["40.6 Outcome"]
N7["Preparing the talk"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]
[Learning outcomes]
|
v
[40.1 Structure]
|
v
[40.2 Argument]
|
v
[40.3 Presentation]
|
v
[40.4 Questions]
|
v
[40.5 Reflection]
|
v
[40.6 Outcome]
|
v
[Preparing the talk]
|
v
[Worked example] --> [Exercise EX118]
Learning outcomes
You will (1) write and present the bachelor's thesis; (2) integrate the course's work into one argument; (3) answer questions; (4) reflect on learning.
40.1 Structure
Introduction with the opening case; background on cloud and container security; methods; studies from chapters 18, 33 and 34; capstone design, implementation and evaluation; discussion; limits; conclusion.
Starting with the opening case gives readers a concrete problem before any theory. The three studies provide evidence that shaped the capstone's design. The discussion connects results back to the opening case, and the chapter on limits states what the thesis cannot show. Each chapter ends with a short summary that the next one builds on, so readers can follow the argument without reading every detail.
40.2 Argument
Westmere's exposure came from missing visibility and secrets in images; combining guardrails, pipeline scanning and a weekly posture report closes these gaps measurably.
The argument rests on evidence from each part of the thesis: the opening case shows the problem, the studies support the choice of controls, and the evaluation shows they work. Samuel avoids claiming StudyHub is secure; he claims the specific gaps are closed and measured. Each claim in the argument points to the chapter where its evidence is presented, so examiners can check it directly. Samuel also states what would weaken the argument, such as the trend reversing once the report becomes routine.
40.3 Presentation
A 20-minute talk with the opening case, three key results and the limits, followed by questions.
The three key results are zero anonymous repositories, full logging coverage and the fall in open findings. Each has a single slide with the number and its source. The limits slide comes before the conclusion, so examiners hear them from Samuel rather than raising them as criticisms. Samuel ends with one slide of next steps, the role-binding analysis and infrastructure code scanning, so the audience leaves knowing the work continues. Backup slides cover the studies' detailed results and the grid scores, ready for the questions most likely to come.
40.4 Questions
Examiners ask why not buy a commercial posture tool. Samuel answers that built-in services and a small script met the needs, but a tool could be reconsidered if the estate grows. They ask how the report avoids becoming noise; he shows owner assignment and the falling findings trend.
His answers draw on evidence from the project rather than opinion: the cost comparison from the comparative chapter, and the owner column and findings trend from the evaluation. Samuel admits that a commercial tool might offer features he did not build, which examiners noted as a balanced answer.
40.5 Reflection
Samuel writes that the most important skill was turning a vague worry into checkable statements and evidence.
He links the skill to the first chapter's lesson: "StudyHub is secure" could not be checked, but "no registry repository allows anonymous pull" could. Every later part of the project, from scripts to studies to the capstone, followed the same pattern of turning concerns into statements that evidence could support or refute. He also reflects on what he would do differently: start the logging fix earlier, since it was the gap that made the opening case impossible to measure, and test the export loaders against format changes from the beginning, which would have saved the buffer week.
40.6 Outcome
The thesis passes with a high mark; Westmere's cloud team offers Samuel a graduate role.
The graduate role means Samuel will continue to own parts of the work he started, though the report itself remains with Tom's team as agreed. The student volunteering scheme that grew from his placement continues with a new cohort. Samuel's thesis, scripts and synthetic data are archived with the department, so next year's students can build on them. Tom reports that the weekly posture report is still running each Monday under its new owner, with findings assigned in the planning meeting as before.
Preparing the talk
Samuel rehearses three times with classmates, cutting slides each time until the talk fits comfortably in 20 minutes. He prepares backup slides with detailed results for likely questions. The opening slide shows the anonymous registry finding in one sentence; the closing slide shows the three layers now in place. Classmates' questions in rehearsal match two of the examiners' questions, so he is ready for them.
Thanks
The thesis acknowledges the cloud team.
Worked example
In his final reflection, Samuel notes that the anonymous registry from the opening case would now be blocked by a guardrail, detected by an event alert in minutes and listed in the weekly report, three independent layers where there had been none.
Synthetic case. People and outcomes are synthetic.
Errors and limits
Presentations should match the thesis claims, not exaggerate them.
Exercises
- EX118 — Argument. State the thesis argument. Rubric: 3 = guardrails, scanning, posture report close gaps; 2 = partial; 1 = vague; 0 = none.
- EX119 — Commercial tool. How did Samuel answer the tool question? Rubric: 3 = built-ins met needs; reconsider if estate grows; 2 = partial; 1 = vague; 0 = none.
- EX120 — Three layers. What three layers now cover the registry case? Rubric: 3 = guardrail, event alert, weekly report; 2 = two; 1 = one; 0 = none.
Synthesis
The thesis ties the course together into one evidenced argument.
Continue studying — chapter 40 of 40
← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →