◇ OpenCyber Academy
Bachelor's · Chapter 40 · English

Chapter 40 — Thesis and presentation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 40 — Thesis and presentation

Lesson map

Lesson 40 published. Map, example, EX118.

flowchart TD
  N0["Learning outcomes"]
  N1["40.1 Thesis structure"]
  N2["40.2 Public versus restricted"]
  N3["40.3 The presentation"]
  N4["40.4 Two audiences"]
  N5["40.5 Answering questions"]
  N6["40.6 After the thesis"]
  N7["Citing standards correctly"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX118"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["40.1 Thesis structure"]
  N2["40.2 Public versus restricted"]
  N3["40.3 The presentation"]
  N4["40.4 Two audiences"]
  N5["40.5 Answering questions"]
  N6["40.6 After the thesis"]
  N7["Citing standards correctly"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX118"]

[Learning outcomes]
    |
    v
[40.1 Thesis structure]
    |
    v
[40.2 Public versus restricted]
    |
    v
[40.3 The presentation]
    |
    v
[40.4 Two audiences]
    |
    v
[40.5 Answering questions]
    |
    v
[40.6 After the thesis]
    |
    v
[Citing standards correctly]
    |
    v
[Worked example] --> [Exercise EX118]

Learning outcomes

You will (1) structure a bachelor's thesis in CTI; (2) present findings to technical and non-technical audiences; (3) handle restricted material in public documents; (4) answer examiners' questions with evidence.

40.1 Thesis structure

Abstract, introduction, background (models: kill chain, Diamond, ATT&CK; standards: STIX/TAXII 2.1, TLP 2.0, SP 800-150), method, implementation, evaluation, discussion, ethics and limitations, conclusion, references and appendices (decision log, coding sheets).

Amara drafts the method and implementation chapters first, since they rely on her decision log and are the most concrete. The background chapter explains only the models and standards that her work uses, citing each. The ethics and limitations chapter brings together the decisions recorded throughout the project, so readers see how risks were handled.

40.2 Public versus restricted

Theses are often published by the university. Any TLP:AMBER or RED material from HSSC must be excluded or replaced by synthetic examples. HCHT domains and names may need anonymising with the trust's agreement. Ask HCHT to review the final draft for sensitive content.

Amara replaces all HSSC examples with synthetic ones that show the same patterns, and uses "a regional health trust" for HCHT in the public version. The full version, with real results, is kept on HCHT systems. HCHT's security lead reviews the draft and asks for two further changes, which Amara makes before submission.

40.3 The presentation

Ten minutes: problem, approach, key result, limits, what HCHT should do next. One chart showing precision over weeks says more than five tables.

Amara's chart shows weekly flags and suspicious domains as two lines, which makes the precision visible without a table. She rehearses with her supervisor and cuts a slide on rules that took too long to explain. Backup slides hold the detailed tables for questions. She ends with a single recommendation for HCHT and the cost of following it, which matches the one-page summary for managers.

40.4 Two audiences

Examiners want method and rigour. HCHT managers want "should we keep doing this?" Prepare a one-page summary for managers with a clear recommendation and its cost.

Amara's one-page summary recommends continuing the process for three more months with the new filter, at about an hour a week, and reviewing it then. It lists the six suspicious domains found as the main benefit and the missed pattern as the main gap. HCHT's manager approves the extension based on the page, without needing the full thesis.

40.5 Answering questions

Answer with evidence and admit what you did not measure. "I don't know, but here is how I would find out" is a strong answer.

In her presentation, an examiner asks whether the process would detect lookalikes of HSSC member domains at scale. Amara explains that the three-member pilot found it workable but too small to judge, and describes how she would test it. Another asks about recall, and she explains why it could not be measured directly and what her partial check showed.

40.6 After the thesis

Hand the process over properly: documentation, scripts in HCHT's repository, a named owner and a short training session. A capstone that stops when the student leaves delivers little lasting value; a handed-over process keeps protecting the organisation.

The scripts move into HCHT's repository with the test list and a guide covering the weekly run, triage rules and the decision log. Amara runs one training session and watches the new owner, an HCHT analyst, complete a full week alone. Open questions, including the missed pattern, are listed for the new owner, and she remains available for questions during the next semester.

Citing standards correctly

Cite specification versions and dates, such as STIX 2.1 and TLP 2.0, because later versions change definitions. Examiners notice when a thesis quotes outdated guidance.

Worked example

An examiner asks whether the 24% precision is good. Amara answers that there is no universal benchmark; at 50 minutes per week, the supervisor considered six early warnings worth the time, and she proposes tracking precision as rules improve. She also notes recall was only partially estimated.

Synthetic case. The examination is invented.

Errors and limits

A thesis is a snapshot; threats and tools move on. Date your conclusions.

Exercises

Synthesis

Structure the thesis rigorously, keep restricted material out of public work, speak to both audiences and hand the process over.

Continue studying — chapter 40 of 40

← Chapter 39 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →