Chapter 40 — Thesis and presentation
Lesson map
Lesson 40 published. Map, example, EX118.
flowchart TD
N0["Learning outcomes"]
N1["40.1 Thesis structure"]
N2["40.2 Slides"]
N3["40.3 Anticipating questions"]
N4["40.4 Responsible publication"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX118"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["40.1 Thesis structure"]
N2["40.2 Slides"]
N3["40.3 Anticipating questions"]
N4["40.4 Responsible publication"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX118"]
[Learning outcomes]
|
v
[40.1 Thesis structure]
|
v
[40.2 Slides]
|
v
[40.3 Anticipating questions]
|
v
[40.4 Responsible publication]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX118]
Learning outcomes
You will (1) structure a bachelor's thesis in OT security; (2) design slides that show evidence rather than decoration; (3) prepare for an oral defence with anticipated questions; and (4) publish a replication package responsibly.
40.1 Thesis structure
Introduction (problem, question, contribution); background (standards and prior work, cited precisely — NIST SP 800-82r3, the relevant IEC 62443 parts, ATT&CK for ICS techniques, peer-reviewed papers you have read); method; results; discussion including limitations; conclusion and future work; appendices with code and data descriptions. Keep the synthetic label visible in every figure caption that uses LDHP data.
For Maya's thesis, the background chapter cites ATT&CK for ICS T0836 and CISA AA21-042A for the problem, IEC 62443-3-3 for the zone and conduit controls behind her allow-list, and Urbina et al. for evaluating detectors by attacker impact. Every figure built from LDHP captures carries "synthetic data" in its caption.
40.2 Slides
One message per slide, stated in its title: "Rule-based monitoring missed slow drift; a cumulative rule recovered it". Show the confusion matrix, the denominators and the interval. Avoid hacker imagery and padlock icons; examiners read them as a sign of weak content.
Maya's results slide shows her eight-case matrix with the counts in each cell, three true positives, one false positive, two false negatives, two true negatives, and the Wilson interval for recall of 3/5, roughly 0.23 to 0.88. Its title states the finding rather than "Results". A panel can then ask about the false positive, a flagged maintenance write, without first decoding the chart.
40.3 Anticipating questions
Prepare answers for: Why synthetic data? How would this fail on a real plant? What is the false-alarm burden on operators per shift? Why these attack classes? What would an attacker who knows your rules do? Answering "I don't know, but here is how I would find out" is acceptable; inventing numbers is not.
For the false-alarm question, Maya can answer from her own data: one false positive in eight cases is far too few to estimate per-shift burden, and she says so, with the number of quiet hours she would need to measure it. For the attacker question, her two misses already answer part of it: many small writes inside the allowed range, and writes from HMI-1 itself.
40.4 Responsible publication
Publish code, seeds and synthetic data under an open licence. Do not publish anything that is a working attack against real products. If the work found a real vulnerability, publication waits for coordinated disclosure (Chapter 10).
Maya's thesis repository would contain the monitor's code, the synthetic LDHP captures with their generator and seeds, and the eight labelled cases. It would not contain anything that sends Modbus writes, because the monitor only reads capture files. Had her work revealed a flaw in a real PLC's handling of function code 8, the description in the thesis would wait until the vendor had a fix.
Worked example (synthetic LDHP)
Maya's defence opens with the one-sentence contribution: "A rule-based Modbus write monitor with a cumulative-change rule detected five of six synthetic attack classes on LDHP captures; the remaining class — writes from a legitimate HMI — requires correlation with operator identity." Her closing slide lists three limitations and the successor plan from Chapter 39.
Synthetic case — Lakeside District Heating Plant. The thesis is a worked illustration on simulated data.
Errors and limits
A thesis is judged on reasoning and honesty more than on the size of the result. Long literature chapters that summarise without evaluating add pages, not marks.
Exercises
- EX118 — A slide title that carries the claim. Write the title for the slide showing the 4/5 recall result. Rubric: 3 = full-sentence claim with qualifier; 2 = claim without qualifier; 1 = "Results"; 0 = none.
- EX119 — Defending against an informed attacker. Draft an answer to "what would an attacker who knows your rules do?" Rubric: 3 = admits evasion (e.g. via HMI or below cumulative threshold), cites Urbina-style impact budget, proposes defence; 2 = two; 1 = denies; 0 = none.
- EX120 — What not to publish. Name one item that should be excluded from the public replication package and why. Rubric: 3 = anything usable against real products or any owner-provided data; reason; 2 = item only; 1 = "the code"; 0 = none.
Synthesis
A thesis ends the course by showing that you can frame an OT security question, answer it with honest evidence, and communicate the answer's limits to people who must act on it.
Continue studying — chapter 40 of 40
← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →