Chapter 40 — Thesis and presentation | Bachelor's Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 40 — Thesis and presentation

Lesson map

Lesson 40 published. Map, example, EX118.

flowchart TD
  N0["Learning outcomes"]
  N1["40.1 Thesis structure"]
  N2["40.2 Literature in the thesis"]
  N3["40.3 Discussion"]
  N4["40.4 Limitations"]
  N5["40.5 Presentation"]
  N6["40.6 Reflection"]
  N7["40.7 Next steps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX118"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["40.1 Thesis structure"]
  N2["40.2 Literature in the thesis"]
  N3["40.3 Discussion"]
  N4["40.4 Limitations"]
  N5["40.5 Presentation"]
  N6["40.6 Reflection"]
  N7["40.7 Next steps"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]

[Learning outcomes]
    |
    v
[40.1 Thesis structure]
    |
    v
[40.2 Literature in the thesis]
    |
    v
[40.3 Discussion]
    |
    v
[40.4 Limitations]
    |
    v
[40.5 Presentation]
    |
    v
[40.6 Reflection]
    |
    v
[40.7 Next steps]
    |
    v
[Worked example] --> [Exercise EX118]

Learning outcomes

You will (1) write a bachelor's thesis on the capstone; (2) present findings to academic and SOC audiences; (3) reflect on learning across the degree; (4) plan next steps.

40.1 Thesis structure

Introduction; background (campus threats, SOC practice, literature); the campaign and review; method (rules, tests, scenarios); implementation; evaluation; discussion; limitations; conclusions; references; appendices.

Placing the campaign and review before the method shows readers why the work was needed. The appendices contain the rule pages, test scenarios without personal data and the analysis scripts. Lucas's supervisor reviewed the outline before he wrote, which avoided reorganising later. Each chapter opens with the question it answers and ends with what it found, so a reader can skim the thesis by reading only those paragraphs.

40.2 Literature in the thesis

Lucas draws on Alahmadi et al. (2022) for alarm quality, Axelsson (2000) for base rates, Sundaramurthy et al. (2014) for SOC practice, NIST SP 800-61r3 for response and SigmaHQ conventions for rule documentation.

Each source supports a specific part of the thesis. Base rates justify the attention to false alerts; alarm quality studies explain why analysts' trust matters; SOC practice studies support mixed methods. Lucas cites only what he uses, so the reference list stays short and relevant. He checked each citation against the original source.

40.3 Discussion

The package improved detection of test scenarios and fit analyst capacity; reporting by people remained crucial; attackers' timing defeated early assumptions.

The discussion connects results to the campaign: the package would have detected s3310's deletion rule, which went unseen for hours. It also notes what the package does not change. People reporting suspicious mail remained the first signal in the live period, which supports keeping the report button. The discussion also states what surprised him: the slow attacker, which no early design anticipated, became the most important case in the whole project.

40.4 Limitations

One university; 20 scenarios; four weeks; scenarios designed by defenders; student population specific.

Each limitation is linked to what it affects. Twenty scenarios limit precision; four weeks limit what the false-alert rate shows; defender-designed scenarios may be easier than real attacks. Stating these lets the SOC decide how far to rely on the package and what to test next. He also lists what would reduce each limitation: more scenarios, a longer live period and scenarios written by someone outside the SOC, such as the external firm that runs Riverton's purple exercise. That turns each limitation into a concrete next step the SOC can choose to fund.

40.5 Presentation

A 15-minute talk to the department and a separate 10-minute briefing to the SOC team focusing on how to maintain the package.

The two audiences need different things. The department wants the question, method, results and limits. The SOC team wants to know what each rule does, how to tell a false alert, and how to change thresholds safely. Lucas prepared separate slides for each rather than one talk for both. Both talks end with the same one-sentence result, so the message is consistent.

40.6 Reflection

From mathematical reasoning in chapter 1 to the evaluation, the degree built habits: measure fairly, write precisely, act within authority, test assumptions.

Lucas's reflection connects the first chapter's rates to the evaluation's intervals: both are about not overstating what numbers show. He also notes the habit of asking authority before acting, which shaped his work at Eastbank and in the research server case. He writes that the most useful habit was keeping observations separate from inferences, which made every later report easier to check and defend.

40.7 Next steps

Lucas plans to apply for a junior analyst role and to keep contributing rule improvements to the SOC's repository as an alumnus volunteer under supervision.

Volunteering under supervision keeps the rules maintained by someone who knows them while the next cohort learns. Lucas's access as an alumnus will be limited to the rule repository, not live logs, which Dr. Kim set as a condition. The archive described below makes his work usable without him. He also agreed to mentor next year's first student analysts during their shadowing stage.

Archiving

The final rules, tests, scenarios (without personal data) and analysis scripts are stored in the SOC repository with a README, so the evaluation can be repeated next year with new scenarios and compared directly with Lucas's results.

Acknowledgements

The thesis thanks the student analysts and Dr. Kim, and states that no personal data appears in it.

Worked example

At the presentation, a lecturer asks what Lucas would do with more time. He answers: "Expand scenarios to 60 to narrow the interval, cover internal-then-external forwarding, and measure whether the report button increased student reporting rates."

Synthetic case. The thesis and presentation are invented.

Errors and limits

A thesis records one project; the SOC must keep improving after the student leaves.

Exercises

EX118 — Thesis sections. List the main thesis sections in order. Rubric: 3 = introduction to appendices in order; 2 = most; 1 = few; 0 = none.
EX119 — Two audiences. How did the two presentations differ? Rubric: 3 = department talk on findings; SOC briefing on maintenance; 2 = partial; 1 = same; 0 = none.
EX120 — More time. What would Lucas do with more time? Rubric: 3 = 60 scenarios, internal-external forwarding, measure report-button effect; 2 = two; 1 = one; 0 = none.

Synthesis

The thesis and presentations close the degree by showing measured improvement, honest limits and habits that carry into practice.

Continue studying — chapter 40 of 40

← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →