OpenCyber Academy
Bachelor's · Chapter 40 · English
Course code: OCA-115Chapter 40: OCA-115-C040

Chapter 40 — Thesis and presentation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 40 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["40.1 Thesis structure"]
  N2["40.2 The conclusion"]
  N3["40.3 The presentation"]
  N4["40.4 Answering questions"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["40.1 Thesis structure"]
  N2["40.2 The conclusion"]
  N3["40.3 The presentation"]
  N4["40.4 Answering questions"]
  N5["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX079"]

[Learning outcomes and connection]
    |
    v
[40.1 Thesis structure]
    |
    v
[40.2 The conclusion]
    |
    v
[40.3 The presentation]
    |
    v
[40.4 Answering questions]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes and connection

After this chapter you can (1) structure a bachelor's thesis that reports a comparative, evidence-led capstone; (2) write a conclusion that answers the question within the evidence; (3) present and defend the work to a mixed audience of academics and practitioners; and (4) handle questions, including those you cannot answer, honestly. It completes the course, drawing on every chapter, especially 4, 15, 34 and 35–39.

40.1 Thesis structure

A typical 10,000–12,000-word bachelor's thesis in this course:

  1. Abstract (≈ 250 words): question, method, main result, recommendation, key limitation.
  2. Introduction: the service, the decision problem, the question, why it matters, the structure.
  3. Background and literature: concepts and prior work, with the recorded search strategy.
  4. Method: options, constraints, criteria and scales, weights and how set, evidence plan, models, ethics and authorisation.
  5. Results: evidence per option and criterion, scores, sensitivity analysis — facts, not interpretation.
  6. Discussion: what the results mean, comparison with literature, robustness, directional limitations.
  7. Conclusion and recommendation: the answer, the recommendation, reversal conditions, future work.
  8. References and appendices: evidence register, scripts with hashes, consent forms (blank), host approval.

Write the method chapter first (you know it best), results second, introduction and conclusion last. Every number in the results must come from a script or a register entry.

40.2 The conclusion

A strong conclusion answers the question asked — not a broader one — and says how strongly. Compare: "Network isolation is the best way to secure medical devices" (overclaims) versus "For a mid-sized hospital with the synthetic inventory studied, isolation with monitored conduits reduced exposure most per pound, provided alerts are reviewed daily; the recommendation reverses if cost dominates the decision (weight above 0.45) or if monitoring is unstaffed." The second is narrower and far more useful. The reversal conditions in that conclusion are a cost weight above 0.45, under which the vendor gateway wins, and unreviewed monitoring alerts, under which accelerated replacement wins.

40.3 The presentation

Twenty minutes for a mixed panel: problem and question (3 min), method (4), results (6), recommendation and limits (4), what you would do next (3). One idea per slide; show the comparison table and the sensitivity result; put details in backup slides. Rehearse aloud with a timer and with a non-specialist. For the unsupported-devices capstone, the results minutes show the comparison table and the evaluation's variation table, highlighting the two variations that change the winner; the limits minutes name the staffing condition. Backup slides hold the evidence register and the model test. A rehearsal with a non-specialist usually reveals jargon such as "conduit" that needs one sentence of explanation.

40.4 Answering questions

Questions fall into families: scope ("why not include X?"), method ("why these weights?"), evidence ("how do you know this score?"), validity ("would this hold in a large hospital?"), ethics ("how did you protect the host?") and application ("what should the hospital do on Monday?"). Prepare two answers for each family. When you do not know, say so, say how you would find out and, if you discover an error, acknowledge and correct it. Panels value honesty about limits more than confident improvisation.

40.5 Worked example: a defensible answer (synthetic)

This exchange is synthetic. Panel: "Your recommendation depends on monitoring being staffed. Hospitals are short of staff. Isn't your conclusion unrealistic?" Candidate: "That is the main fragility in my result. In the pessimistic variation, where alerts are not reviewed, accelerated replacement wins (Table 6.3). So my recommendation is conditional: isolation with monitoring where the hospital can commit to daily review — for example through a shared service across the partnership — and accelerated replacement of the most exposed imaging devices where it cannot. I could not test staffing levels directly; a follow-up study would measure alert review times across several hospitals."

40.6 Common errors and limits

The candidate answers the staffing challenge from Table 6.3: if alerts are not reviewed, accelerated replacement wins, so the recommendation is conditional on daily review. A results chapter that says "isolation is clearly better" mixes interpretation into results. A conclusion about "medical devices" generally claims more than a 120-device synthetic inventory supports. Slides that reach the recommendation in minute 19 leave no time for limits. And a host's device names on a slide breach the placement agreement even if the thesis was sanitised.

Exercises — chapter 40

EX079 — Write the abstract. Objective: compress the capstone. Inputs: the synthetic capstone of Chapters 35–39. Steps: write a 200–250-word abstract with question, method, main result, recommendation with condition and one limitation. Expected evidence: abstract. Rubric: 3 = all five elements, numbers where relevant, no overclaiming; 2 = one missing; 1 = descriptive only; 0 = none.

EX080 — Question bank. Objective: prepare for defence. Inputs: your capstone (or the synthetic one). Steps: write one question per family listed under answering questions and a three-sentence answer to each. Expected evidence: six questions and answers. Rubric: 3 = realistic hard questions with honest, evidence-linked answers and at least one "I don't know, but…" answer; 2 = easy questions; 1 = questions only; 0 = none.

Chapter synthesis

The thesis reports a comparison, not a story: method, results, discussion and a conclusion that answers exactly the question asked with its conditions. Present the comparison and its sensitivity clearly, prepare for every family of question and answer hard ones honestly — that is the professional habit this course exists to build.

Worked answers

EX079. Model (≈ 220 words): "Hospitals keep clinical devices whose software is no longer supported, because devices outlive their operating systems. This capstone asked which of three approaches — accelerated replacement, network isolation with monitoring, or vendor-managed secure gateways — best reduces exposure for a mid-sized hospital within a fixed budget. Using a synthetic inventory of 120 devices built from published categories, an exposure model tested against a hand-worked case, one practitioner interview and public guidance, the options were compared on consequence reduction, clinical disruption, cost and evidence strength with weights set in advance. Isolation with monitoring scored highest and remained preferred unless cost carried more than 45% of the decision weight, in which case vendor gateways were preferred, or monitoring alerts were not reviewed, in which case accelerated replacement of the most exposed imaging devices was preferred. Vendor gateways underperformed for imaging devices because archive connections bypass them. We recommend isolation with monitored conduits where daily alert review can be committed, and prioritised replacement elsewhere. The main limitation is the synthetic inventory and single interview, which probably make isolation's clinical disruption look smaller than it is."

EX080. Example questions: scope — "Why not include cloud-hosted imaging?" (out of scope by design; would change exposure; future work). Method — "Why these weights?" (set with the host before scoring; sensitivity shown; reversal at 0.45). Evidence — "How do you know isolation's disruption score?" (one interview plus guidance; acknowledged as weak; directional limitation). Validity — "Would this hold in a large teaching hospital?" ("I don't know; the inventory mix differs; I would test with their category distribution"). Ethics — "How did you protect the host?" (synthetic data, anonymised interview, host review). Application — "What should the hospital do on Monday?" (restrict and monitor the imaging conduits; start the replacement case for the top five exposed devices).