Chapter 37 — Dissertation I: proposal
Lesson map
Lesson 37 published. Map, example, EX109.
flowchart TD
N0["Learning outcomes"]
N1["37.1 Proposal structure"]
N2["37.2 Literature"]
N3["37.3 Analysis plan"]
N4["37.4 Timeline"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX109"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["37.1 Proposal structure"]
N2["37.2 Literature"]
N3["37.3 Analysis plan"]
N4["37.4 Timeline"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX109"]
[Learning outcomes]
|
v
[37.1 Proposal structure]
|
v
[37.2 Literature]
|
v
[37.3 Analysis plan]
|
v
[37.4 Timeline]
|
v
[Worked example] --> [Exercise EX109]
Learning outcomes
You will (1) write a dissertation proposal; (2) review relevant literature; (3) plan analysis and timeline.
37.1 Proposal structure
Aisha writes her proposal with an introduction stating the problem, a literature review, the research question, design, measures, ethics, analysis plan and timeline. She keeps it to eight pages. Dr. Carrow reviews it and asks her to explain why leaver removal matters, so readers outside security understand the stakes. She adds a paragraph explaining that former staff accounts can be misused by the former employee or by attackers who find them unmonitored. Dr. Carrow approves the proposal after one round of comments.
37.2 Literature
Aisha reviews literature on access management. Standards such as ISO/IEC 27002:2022 give guidance on managing access rights, including removal when employment ends. NIST SP 800-53 Revision 5 includes account management controls requiring timely disabling. She finds few published studies measuring removal times in small organisations, which gives her dissertation a modest but real contribution. Dr. Carrow reminds her to cite standards by edition. She also reads Anderson's Security Engineering, which discusses how organisations often struggle to keep access rights aligned with people's current roles. She notes the passage in her literature review as context for why removal delays occur in practice.
37.3 Analysis plan
Aisha plans her analysis: compare median days to disable before and after, compare the share disabled within one day and examine any leavers with long delays individually. She will also check for rival explanations, such as changes in leaver numbers or IT staffing. She writes the plan before receiving data, and Dr. Carrow signs it. She learns that a written plan protects her from choosing analyses after seeing results. She stores the signed plan with her ethics approval, so examiners can see it predates the data.
37.4 Timeline
Aisha's timeline allocates four weeks for data collection, four for analysis, six for writing and two for revision. She builds in a two-week buffer for delays. Dr. Carrow notes that data access often takes longer than expected in real organisations. She sends the data request to Ashfield early, with the ethics approval attached. Ashfield responds within a week, and the IT manager agrees to provide the anonymised records within a month. Aisha records the request date and the promised delivery date in her project log, so any delay can be explained in the dissertation if needed.
Worked example
Aisha writes an eight-page proposal, reviews ISO/IEC 27002 and SP 800-53 guidance on access removal, writes an analysis plan before data and builds a timeline with a buffer.
Synthetic case. The proposal is synthetic.
Errors and limits
Choosing analyses after seeing results invites bias.
Exercises
- EX109 — Stakes paragraph. Why does leaver removal matter? Rubric: 3 = former accounts can be misused;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX110 — Literature gap. What gap does Aisha find? Rubric: 3 = few studies measuring removal times in small organisations;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX111 — Buffer. How long is the timeline buffer? Rubric: 3 = two weeks;; 2 = partly correct;; 1 = wrong;; 0 = none.
Continue studying — lesson 37 (chapter 37 of 40)
← Chapter 36 · Course chapter index · Chapter 38 →
Continue to the next authored lesson.