Chapter 4 — Academic writing
Lesson map
Lesson 04 published. Map, example, EX007.
flowchart TD
N0["Learning outcomes and connection"]
N1["4.1 Writing is part of the security work"]
N2["4.2 Structure for two readers"]
N3["4.3 Citation and honesty"]
N4["4.5 Practical activity"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX007"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["4.1 Writing is part of the security work"]
N2["4.2 Structure for two readers"]
N3["4.3 Citation and honesty"]
N4["4.5 Practical activity"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX007"]
[Learning outcomes and connection]
|
v
[4.1 Writing is part of the security work]
|
v
[4.2 Structure for two readers]
|
v
[4.3 Citation and honesty]
|
v
[4.5 Practical activity]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX007]
Learning outcomes and connection
After this chapter you can (1) structure a short technical argument as claim, evidence, reasoning and limits; (2) cite sources so that a reader can find exactly what you relied on; (3) write for two audiences at once — a specialist who will check your reasoning and a decision-maker who has five minutes; and (4) distinguish your own analysis from what a source says. It builds on Chapter 1's explicit assumptions and prepares Chapter 18 (research methods) and the capstone thesis (Chapter 40).
4.1 Writing is part of the security work
In critical services, much security work ends as a document: a risk assessment, an incident report, a recommendation to a board, a submission to a regulator. A correct analysis that is badly written is often ignored; a well-written analysis with a hidden assumption can mislead a whole organisation. Academic writing is training for both problems. Its core is the argument: a claim supported by evidence through stated reasoning, with its limits acknowledged. Toulmin's model names these parts — claim, data (evidence), warrant (the reasoning that connects them), backing, qualifier and rebuttal (Toulmin, The Uses of Argument). You do not need the vocabulary in every paragraph, but you should be able to point to each part.
4.2 Structure for two readers
Put the conclusion first. A decision-maker reads the first paragraph; a specialist reads everything. A useful structure for a short report is: summary (the recommendation and its main reason, in three sentences); context (what service, what question, what scope); evidence (what you examined and found, with sources); analysis (how the evidence supports the recommendation, and the alternatives you compared); limits (what you did not examine, what would change your conclusion); references. Use headings that say something ("Unsupported devices are concentrated in imaging") rather than labels ("Findings").
4.3 Citation and honesty
Cite a source whenever you state a fact you did not establish yourself, and cite the specific document — the NIST publication number and revision, the agency advisory identifier, the article's DOI — not "according to NIST". Quote sparingly and exactly; paraphrase in your own words and still cite. Separate reporting ("CISA's advisory states that…") from inference ("this suggests that…") from recommendation ("CVH should…"). Never cite a source you have not read; if you rely on a summary of a paywalled standard, cite the summary. Generative tools can draft fluent text that contains invented citations: every reference in your work must be one you opened and checked.
4.4 Worked example: rewriting a weak paragraph (synthetic)
Weak (synthetic student draft): "Hospitals are very vulnerable to cyber attacks, as everyone knows from WannaCry. CVH has lots of old computers so it is at high risk and should buy a new firewall."
Problems: an unsupported universal claim ("everyone knows"); a real incident used without a source or a precise lesson; "lots" and "high" without numbers; a recommendation that does not follow from the evidence (old computers are not fixed by a firewall).
Revised: "The UK National Audit Office found that the 2017 WannaCry ransomware disrupted at least a third of NHS trusts in England, and that affected organisations had unpatched or unsupported Windows systems (NAO, 2017). CVH's sample inventory shows four of five clinical devices past end of support (Chapter 3, Lab 2). We recommend isolating these devices to the connections they need and setting replacement dates, rather than relying on a perimeter firewall, because the NAO case shows harm spreading inside hospital networks. This recommendation assumes the sample is representative; a full inventory is needed to confirm it."
4.5 Practical activity
Take a one-page news article about any infrastructure incident. Write a 250-word brief for a hospital director: three-sentence summary, what is known (with the article and any primary source it cites), what is uncertain, and one question CVH should ask itself. Mark each sentence R (reporting), I (inference) or C (recommendation).
A good brief keeps the three kinds of sentence visibly apart. "The utility reported a six-hour outage (R)" is reporting; "the outage probably began in the billing system (I)" is inference and should name its basis; "CVH should check whether its own billing system can stop clinical work (C)" is a recommendation. Where the article cites a primary source, open it and cite that instead.
4.6 Common errors and limits
- Burying the conclusion on page four.
- Citing a secondary summary as if it were the primary source.
- Words that hide quantities: "many", "significant", "critical" without a number or definition.
- Recommendations that do not follow from the evidence presented.
- Plagiarism, including close paraphrase without citation and unacknowledged AI-generated text.
The weak paragraph in the worked example shows four of these at once: "everyone knows" hides a source, "lots of old computers" hides a count, "high risk" hides a definition, and "buy a new firewall" does not follow from unsupported devices. The fifth error is the one assessors check mechanically: a sentence close to the NAO report's wording without a citation is plagiarism even if the facts are right.
Exercises — chapter 4
EX007 — Find the warrant. Objective: expose hidden reasoning. Inputs: "Calder Mutual's payment system had no outage last year, so it is secure." Steps: identify claim, evidence and the unstated warrant; explain why the warrant fails; rewrite the claim so it is supported by the evidence. Expected evidence: three labelled parts and a rewritten sentence. Rubric: 3 = warrant identified ("absence of outage implies absence of weakness"), failure explained, defensible rewrite; 2 = partial; 1 = claim/evidence only; 0 = none.
EX008 — Summary first. Objective: write for a decision-maker. Inputs: the Chapter 1 worked example. Steps: write a 120-word summary recommending option B, including the main reason, the main assumption and what would change the recommendation. Expected evidence: the summary. Rubric: 3 = recommendation in the first sentence, reason, assumption and reversal condition, ≤ 120 words; 2 = one element missing; 1 = recommendation buried; 0 = none.
Chapter synthesis
Good security writing states a claim, shows the evidence, makes the reasoning explicit and admits the limits — conclusion first, sources exact, reporting kept apart from inference and recommendation. Write as if a specialist will check every sentence and a decision-maker will read only the first three.
Continue studying — chapter 04 of 40
← Chapter 03 · Course chapter index · Chapter 05 →
Continue to the next authored lesson.