◇ OpenCyber Academy
Bachelor's · Chapter 4 · English

Chapter 4 — Academic writing

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Academic writing

Lesson map

Lesson 04 published. Map, example, EX010.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Purpose"]
  N2["4.2 Structure"]
  N3["4.3 Citing"]
  N4["4.4 Paraphrase and quotation"]
  N5["4.5 Hedging"]
  N6["4.6 Revision"]
  N7["4.7 Feedback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX010"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Purpose"]
  N2["4.2 Structure"]
  N3["4.3 Citing"]
  N4["4.4 Paraphrase and quotation"]
  N5["4.5 Hedging"]
  N6["4.6 Revision"]
  N7["4.7 Feedback"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX010"]

[Learning outcomes]
    |
    v
[4.1 Purpose]
    |
    v
[4.2 Structure]
    |
    v
[4.3 Citing]
    |
    v
[4.4 Paraphrase and quotation]
    |
    v
[4.5 Hedging]
    |
    v
[4.6 Revision]
    |
    v
[4.7 Feedback]
    |
    v
[Worked example] --> [Exercise EX010]

Learning outcomes

You will (1) write clear academic and technical prose; (2) structure arguments with claims and evidence; (3) cite sources correctly; (4) avoid plagiarism and overclaiming.

4.1 Purpose

University assignments and SOC reports share a need: a reader must follow the argument and check the evidence. Academic writing makes claims explicit and supports each with sources or data.

When Lucas wrote his first incident summary, Dr. Kim needed to forward it to the university's data protection officer, who had not seen the logs. Every claim, such as "two accounts were compromised", had to point to the evidence behind it, so the officer could judge it without asking Lucas to explain each step in person.

4.2 Structure

A paragraph opens with its claim, gives evidence, explains how the evidence supports the claim and notes limits. Reports and essays follow the same pattern at larger scale.

A paragraph from Lucas's summary followed this shape: claim, two accounts were compromised; evidence, both clicked the link and signed in from an unusual country shortly afterwards; reasoning, the combination is a strong indicator; limit, other accounts may have been compromised without an unusual-country sign-in. The limit tells readers what is still uncertain.

4.3 Citing

Every borrowed idea or figure is cited. Lucas cites NIST SP 800-61r3 for incident response phases and Alahmadi, Axon and Martinovic (2022) for analysts' views of alarms, using the referencing style his course requires.

Citing the incident response guide lets readers check that the phases Lucas describes match the source rather than his memory of it. When he summarised findings about alarm fatigue, the citation showed the claim came from a study of analysts, not from his own opinion, which made Dr. Kim more willing to use it in a budget request.

4.4 Paraphrase and quotation

Paraphrasing restates ideas in new words and still needs a citation; quotation uses exact words in quotation marks. Copying without either is plagiarism.

Lucas uses quotation sparingly, mostly for precise definitions where exact wording matters, such as a phase name in the response guide. For most material he paraphrases, which shows he understood the idea, and adds the citation. When unsure whether a sentence is too close to the original, he rewrites it after closing the source, then compares the two.

4.5 Hedging

Claims should match evidence. "The phishing campaign compromised two accounts" is supported; "the campaign was run by a criminal group" is not, unless evidence shows it.

Lucas's draft said the sender was "clearly a criminal group"; the logs showed only the sending infrastructure and the fake page. Dr. Kim asked him to replace it with what was known: the campaign used a newly registered domain and a page copying Riverton's sign-in screen. Claims about who was behind it were left to those with evidence.

4.6 Revision

First drafts are for thinking; later drafts for readers. Lucas reads his work aloud to find unclear sentences.

His first draft of the incident summary was a timeline in the order he had discovered things. The revised version led with the outcome, two compromised accounts contained, and followed with the evidence, which suited readers who needed the result first. Reading aloud caught a sentence that used "they" for both the attacker and the victims, which confused the order of events.

4.7 Feedback

Dr. Kim comments on drafts; Lucas keeps a list of recurring issues to avoid them next time.

After three assignments, Lucas's list included missing denominators, vague claims about attackers and unexplained abbreviations such as IdP. He checked each new draft against the list before submitting it. By the end of term, Dr. Kim's comments had shifted from these basics to questions about evidence and reasoning, which was the point of keeping the list. The list itself became shorter each month.

Writing for SOC readers

SOC reports use the same discipline but shorter forms: a summary first, then evidence in tables with sources, then limits. Lucas practises both styles so he can switch between essays and incident notes without losing precision about what is known and what is inferred.

Worked example

Lucas's draft sentence: "Most security alerts are useless." Dr. Kim asks for evidence. He revises: "In interviews, SOC practitioners described most alarms as benign triggers — legitimate activity matching a rule (Alahmadi et al., 2022)." The revision is narrower, sourced and accurate.

Synthetic case. The drafts are invented.

Errors and limits

Good writing cannot rescue weak evidence; gather evidence first.

Exercises

Synthesis

Academic writing pairs every claim with evidence, cites honestly and keeps claims within what evidence supports.

Continue studying — chapter 04 of 40

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →