OpenCyber Academy
Doctoral research · Chapter 8 · English
Course code: OCA-207Chapter 08: OCA-207-C008

Chapter 8 — Defense and publication plan

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["8.1 The claim audit"]
  N2["8.2 Preparing the defense"]
  N3["8.3 Publication plan"]
  N4["8.4 Coordinated disclosure and sector coordination"]
  N5["8.5 Translating to policy and practice"]
  N6["8.6 The post-doctoral program"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["8.1 The claim audit"]
  N2["8.2 Preparing the defense"]
  N3["8.3 Publication plan"]
  N4["8.4 Coordinated disclosure and sector coordination"]
  N5["8.5 Translating to policy and practice"]
  N6["8.6 The post-doctoral program"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX034"]

[Learning outcomes and connection]
    |
    v
[8.1 The claim audit]
    |
    v
[8.2 Preparing the defense]
    |
    v
[8.3 Publication plan]
    |
    v
[8.4 Coordinated disclosure and sector coordination]
    |
    v
[8.5 Translating to policy and practice]
    |
    v
[8.6 The post-doctoral program]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes and connection

By the end of this chapter the learner will be able to:

  1. Audit a thesis claim register for unsupported, unscoped and overgeneralized claims before the defense.
  2. Prepare for a defense by anticipating the strongest examiner questions and answering with evidence, scope and limits.
  3. Plan a sequence of publications across communities that preserves the integrity of the overall argument.
  4. Integrate coordinated disclosure and sector coordination into the publication timeline when findings touch vulnerabilities or attack surfaces.
  5. Translate a narrowed research claim into policy and practice recommendations without inflating it.
  6. Turn the thesis's limitations into a credible post-doctoral research program.

Chapter 7 assembled the thesis and its archive. This chapter prepares the candidate to defend it and to release it responsibly — the final step of the book and of the 207-course study path.

8.1 The claim audit

Before the defense, every claim in the thesis — in the abstract, introduction, chapter conclusions and general conclusion — goes into a claim register with its evidence, scope and limitations. Abstracts and conclusions are where overclaiming accumulates, because they are written last, in a hurry, for impact.

8.1.1 Practical activity: an automated first pass

# Lab 8 - audit a thesis claim register before the defense (offline)
claims = [
    {"id": "K1", "text": "Dependency-aware restoration reduced weighted critical-service loss in the Riverbend model",
     "evidence": ["Ch5-MC"], "scope": "synthetic model, single crew, 4 feeders", "limits": ["model-policy circularity"], "status": "supported"},
    {"id": "K2", "text": "The benefit persists when generator fuel buffers double",
     "evidence": ["Ch6-boundary"], "scope": "gen_scale 2-4", "limits": [], "status": "supported"},
    {"id": "K3", "text": "Operators would adopt the dependency-aware ordering",
     "evidence": [], "scope": "", "limits": [], "status": "supported"},
    {"id": "K4", "text": "Dependency-aware restoration improves resilience of US utilities",
     "evidence": ["Ch5-MC", "Ch6-PortHalvard"], "scope": "two synthetic regions", "limits": ["no field data"], "status": "supported"},
]
OVERREACH = ("US utilities", "all utilities", "proves", "always")
for c in claims:
    problems = []
    if c["status"] == "supported" and not c["evidence"]:
        problems.append("no evidence for a supported claim")
    if not c["scope"]:
        problems.append("scope missing")
    if not c["limits"]:
        problems.append("no stated limitation")
    if any(w in c["text"] for w in OVERREACH) and "synthetic" in c["scope"]:
        problems.append("text generalizes beyond its synthetic scope")
    print(c["id"], "OK" if not problems else "; ".join(problems))

Expected output:

K1 OK
K2 no stated limitation
K3 no evidence for a supported claim; scope missing; no stated limitation
K4 text generalizes beyond its synthetic scope

The script catches three classic failures. K2 is supported but states no limitation — yet Chapter 6 showed that the benefit over SILO shrinks sharply as buffers grow, so "persists when buffers double" needs the qualifier that the benefit falls by about 85% at twice the buffers. K3 is marked supported with no evidence: the tabletop showed that a display can shift choices in a tabletop, which is not adoption. K4 generalizes from two synthetic regions to "US utilities". A keyword filter is crude — it would miss "nationwide" or "the grid" — so the script is a first pass; the decisive audit is a human reading every claim against the register.

8.1.2 Corrected claims

Lesson table; scroll horizontally to read all columns →

ID Corrected text
K1 In the synthetic Riverbend model, all criticality-aware orderings reduced weighted critical-service loss by about 90% relative to customer-first ordering, at about 70% more customer-hours; time-to-impact ordering did not improve on critical-flag ordering there.
K2 The advantage of criticality-aware ordering over customer-first ordering fell by about 85% when buffers were doubled and vanished at four times the elicited buffers.
K3 In a tabletop with twelve participants from three synthetic utilities, a time-to-impact display shifted seven participants' chosen orderings toward the lower-consequence ordering; adoption in practice was not studied.
K4 Across two synthetic regions and 200 generated regions, time-to-impact ordering improved on critical-flag ordering only where their orders diverged; how often this occurs in real regions is unknown.

8.2 Preparing the defense

8.2.1 What examiners test

Examiners test whether the candidate is an independent researcher: whether they understand their contribution's limits better than anyone, can defend design choices against alternatives, and know the literature well enough to place the work. Expect questions in six families:

Lesson table; scroll horizontally to read all columns →

Family Example question for the Cascade Study What a strong answer contains
Contribution "What is new here, given that utilities already keep critical-customer lists?" The narrowed claim; the conditions under which timing adds value; the measurable preconditions (divergence, map accuracy); the scheduling-theory framing.
Design "Why simulation and a tabletop rather than a field study?" Safety and ethics (never test on production); rarity of real events; the use of historical validation; what a field pilot during exercises would add next.
Validity "Isn't the result circular?" The mismatch test; independent modeller for Port Halvard; the generator analysis; what remains circular.
Values "Who decided that hospitals matter five times more than a telecom office, and why should anyone accept it?" Elicitation process, panel, date, sensitivity of verdicts to weights (EX034), explicit statement that weights are a policy choice.
Ethics and dual use "Have you just told adversaries to attack restoration-priority data?" The dual-use review; general-level publication; defensive recommendation; coordination before publication.
Field knowledge "How does your work relate to consequence-driven engineering approaches?" CCE's consequence-first logic; the thesis as a contribution to the recovery side; differences in unit of analysis.

8.2.2 Mock defenses

Hold at least two mock defenses: one with friendly experts in the domain and one with a hostile methodologist from outside it. Record the questions you could not answer well; each is either a gap in the thesis (fix it), a gap in your preparation (study it) or a genuine open question (say so in the defense — "I don't know, and here is how I would find out" is a strong answer).

8.2.3 Answering

Answer the question asked, then give evidence, then state the limit. Avoid three habits: defending a claim stronger than the thesis makes; conceding a point that the thesis actually addresses because of nerves; and filling silence with speculation. When an examiner proposes an alternative explanation you did not test, the best response describes the test that would distinguish it and what each outcome would mean.

8.3 Publication plan

8.3.1 Sequencing papers

The Cascade Study naturally divides into papers for different communities:

  1. Methods/OR paper. Restoration ordering under buffer-limited critical services: the scheduling framing, the oracle bound, the heuristic and its failure modes, the 200-region analysis. Audience: reliability, risk and operations-research venues.
  2. Infrastructure-security paper. Dependency-map integrity as a precondition of criticality-aware restoration, with the mismatch results and the dual-use-reviewed defensive recommendation. Audience: critical-infrastructure-protection venues and CPS-security workshops.
  3. Human-factors paper. The tabletop study: display, choices, rationales and omitted variables. Audience: human factors and emergency management.
  4. Replication note. The GridWater-Sim reproduction after correcting a parameter-order ambiguity, with the verification tests. Audience: the benchmark's community; also valuable as a data or software paper.

Publish the archive's T0 components with persistent identifiers alongside the first paper, so later papers cite the same versioned artifacts. Each paper must state the overall claim's scope and must not cite another paper from the thesis as stronger evidence than it is.

8.3.2 Preprints, embargoes and sensitive results

Preprints accelerate feedback and establish priority. For results that touch attack surfaces, decide before the preprint whether coordination is needed (§8.4); a preprint is a publication. Funders and partners may have notice periods in their agreements (Chapter 1, §1.5.3); honour them, and refuse any request that would amount to a veto on findings.

8.4 Coordinated disclosure and sector coordination

Infrastructure research can produce three kinds of sensitive finding, each with its own route:

Lesson table; scroll horizontally to read all columns →

Finding Example Route
A product vulnerability A flaw in a vendor's outage-management software found while building the simulator Coordinated vulnerability disclosure to the vendor, directly or through a coordinator such as CISA's CVD program; international practice is described in ISO/IEC 29147 (disclosure) and ISO/IEC 30111 (handling).
An organization-specific weakness A partner's critical-customer list has wrong feeder assignments Private report to the partner under the data-use agreement; never published in identifiable form.
A sector-level attack surface Restoration-priority data and dependency maps are high-value targets whose corruption amplifies outages Coordinate with partners and, where appropriate, the relevant sector information-sharing organization before publication; publish at a general level with defensive recommendations.

Build the coordination period into the timeline. CISA describes its process as covering supplier outreach, analysis, remediation coordination and advisory publication, and notes that it may disclose after a period if a vendor is unresponsive; read the current policy rather than relying on a summary. The thesis records what was disclosed, to whom, when, and what was withheld.

8.5 Translating to policy and practice

Policy audiences need recommendations that follow from the evidence and say how confident they are. From the narrowed Cascade Study claim, defensible recommendations are:

  1. Make the trade-off explicit. Prioritizing critical services in restoration costs ordinary customers time without power; the size of that cost should be estimated and discussed in emergency plans and, where appropriate, public consultation. (Strong evidence within the model; the direction is a scheduling-theory result.)
  2. Audit dependency maps. Criticality-aware restoration is only as good as the feeder-to-facility map and buffer data behind it; utilities and their partners should verify these regularly. (Strong evidence of fragility within the model.)
  3. Protect restoration-priority data. Treat critical-customer lists, dependency maps and buffer inventories as sensitive and integrity-critical. (Inference from the mismatch results and public threat reporting; moderate confidence.)
  4. Measure divergence before changing practice. A utility can determine whether time-to-impact ordering would change its current critical-list order; if not, it gains nothing from adopting it. (Conditional on the model; low cost to check.)

These map naturally onto risk-management processes that already exist — sector risk management under NSM-22 in the United States, risk assessments of critical entities under the CER Directive in the EU — without claiming that any authority should mandate them. A policy brief is two pages, states its evidence base and its limits, and links to the thesis and archive.

8.6 The post-doctoral program

The limitations table of Chapter 7 is a research agenda. A credible three-study program:

  1. Real-region divergence survey (empirical, protected): measure, under T3 protection, how often time-to-impact and critical-list orders diverge across a sample of utilities. This answers the question the synthetic generators could not.
  2. Human-buffer modelling (model + validation): represent buffer extension (fuel deliveries, trucked water) as conditional on telecom and road access, validate against after-action records, and re-test the restoration claims.
  3. Integrity attacks on planning data (security + simulation): model adversarial corruption of dependency maps and priority lists, evaluate detection and audit strategies, and estimate their consequence value — a direct continuation of the dual-use finding, conducted with sector partners.

Each study has a falsifiable claim, a safe design and a partner model, and each would change a decision someone makes.

8.7 Worked example: a defense exchange (synthetic)

Examiner: "Your Port Halvard region was designed to make your method win. Why should I believe anything beyond Riverbend, where it failed?"

Candidate: "You are right that Port Halvard was selected so that the mechanism could operate; the selection criteria were preregistered before simulation, and a different modeller built it, but it is a test of the mechanism, not an estimate of how often the method helps. That is why I ran the 200-region analysis, where the gain over flag ordering is exactly zero whenever the two orders coincide and grows with divergence, and why the thesis claims nothing about how often divergence occurs in real regions. The Riverbend failure is part of the claim: it shows the method adds nothing where orders coincide or where weights and fan-out favour another order. If you want an estimate for real utilities, the study I would run first is the divergence survey I describe in the conclusion."

The answer concedes what is true, cites the specific evidence, restates the narrowed claim and names the next study. It does not defend the original, broader claim.

8.8 Common errors and limits

  • Abstracts and conclusions that claim more than the chapters.
  • Treating the defense as a presentation rather than an examination of independence.
  • Publishing papers whose claims drift beyond the thesis's scope.
  • Posting preprints before deciding whether coordination is needed.
  • Policy recommendations without confidence levels or evidence links.

  • Post-doctoral plans that repeat the thesis instead of addressing its limitations.

  • Keeping a claim register but auditing it only by keyword, which misses overreach phrased as nationwide or the grid.

  • Answering an examiner's alternative explanation by defending the original claim instead of describing the test that would distinguish them.
  • Posting the infrastructure-security paper before partners and the sector information-sharing body have been consulted on the map-integrity finding.
  • Citing one paper from the thesis as stronger evidence than it is in the next paper.
  • Writing policy recommendations that imply a mandate the evidence does not support.

Exercises — chapter 8

EX045 — Claim audit. Objective: audit a claim register. Inputs: Lab 8. Constraints: offline. Steps: (1) run the lab and record the output; (2) add a claim K5, "Our method makes the grid resilient to cyber attacks", with evidence ["Ch5-MC"], scope "synthetic model" and limits ["no field data"]; (3) show that the script misses it; (4) improve the check and re-run; (5) write corrected text for K5. Expected evidence: code, outputs, corrected claim. Rubric: 3 = demonstrates the miss, a sensible improved check (for example, terms such as "the grid" or "resilient to" combined with synthetic scope), corrected claim properly bounded; 2 = check improved but the claim is still inflated; 1 = not run; 0 = none.

EX046 — Examiner question bank. Objective: prepare for the defense. Inputs: your thesis or the Cascade Study. Constraints: at least two questions in each of the six families in §8.2.1; a model answer of at most 120 words for the three hardest. Steps: (1) write at least two questions in each family; (2) mark the three hardest; (3) draft a model answer of at most 120 words for each; (4) identify any question that reveals a gap in the thesis rather than in your preparation. Expected evidence: question bank and answers. Rubric: 3 = questions sharp and specific, answers follow the question–evidence–limit pattern, at least one real gap identified; 2 = answers defensive; 1 = generic questions; 0 = none.

EX047 — Publication plan. Objective: sequence papers with integrity. Inputs: the Cascade Study or your thesis. Constraints: three to five papers; audience, claim and evidence for each; archive versioning; coordination checkpoints. Steps: (1) list the papers with their audiences; (2) state each paper's claim and the evidence it uses; (3) map the shared artifacts and their versions; (4) mark where coordination or dual-use review must happen before release. Expected evidence: plan with a timeline. Rubric: 3 = papers distinct and non-overlapping in claims, shared versioned artifacts, coordination placed before any preprint touching attack surfaces; 2 = overlaps or missing checkpoints; 1 = list of titles only; 0 = none.

EX048 — Disclosure routing. Objective: route sensitive findings. Inputs: four synthetic findings: (a) the simulator's partner utility exports its critical-customer list to an unauthenticated internal web page; (b) a commercial outage-management product accepts unsigned configuration imports; (c) across three partners, buffer inventories on paper exceed physical inventories by 20–40%; (d) restoration crews' radio procedures depend on a single repeater site. Constraints: §8.4 routes; state timing and what is published. Steps: (1) classify each finding by kind; (2) choose the route; (3) state who is notified and when; (4) state what is eventually published and at what level. Expected evidence: table. Rubric: 3 = (a) private report to the partner, (b) CVD with the vendor or a coordinator, (c) private reports plus general publication of the gap between paper and physical inventories, (d) private report and a general finding about single points of failure in restoration communications, with sound timing; 2 = one misrouted; 1 = two or more; 0 = none.

EX049 — Policy brief. Objective: translate without inflating. Inputs: the narrowed claim of §6.5 and recommendations in §8.5. Constraints: two pages; confidence level and evidence link for every recommendation; one paragraph on what the research does not show. Steps: (1) write the brief; (2) mark each sentence as evidence, inference or recommendation; (3) remove any sentence that cannot be traced to the thesis. Expected evidence: brief with markings. Rubric: 3 = recommendations traceable and qualified, non-findings explicit, accessible language; 2 = some untraceable sentences; 1 = advocacy without evidence; 0 = none.

EX050 — Post-doctoral research program. Objective: convert limitations into research. Inputs: your EX044 limitations table or §7.7. Constraints: three studies; each with a falsifiable claim, a safe design, a partner model and the decision it would change. Steps: (1) choose three limitations; (2) design a study for each; (3) order the studies by dependency and value; (4) state what result would end the program. Expected evidence: two-page program. Rubric: 3 = studies directly address the most consequential limitations, are falsifiable and safe, and are ordered by dependency, with an honest stopping result; 2 = one study weak; 1 = repeats the thesis; 0 = none.

Chapter synthesis

The defense examines independence: the candidate must know the contribution's limits better than anyone. A claim register, audited by script and by reading, removes the overclaims that accumulate in abstracts and conclusions. Examiners' questions fall into predictable families; answer with evidence and limits, and name the study that would settle what you do not know. Publish in sequence across communities with versioned shared artifacts, and decide on coordination before any preprint touches an attack surface. Route vulnerabilities, organization-specific weaknesses and sector-level attack surfaces differently. Translate narrowed claims into recommendations with confidence levels. The limitations become the next research program — the natural end of a doctoral course and of this study path.

Worked answers

EX034 — Weight sensitivity. With all weights set to 1.0 (500 draws, seed 7): Riverbend SILO 15.00, CRITFLAG 1.32, DEP 1.07, ORACLE 0.54; DEP − CRITFLAG −0.25 (95% Monte Carlo interval −0.41 to −0.08). Port Halvard SILO 14.95, CRITFLAG 8.61, DEP 2.49, ORACLE 2.49; DEP − CRITFLAG −6.12 (−6.24 to −6.00). Verdicts: H1 unchanged (supported); H2 in Riverbend changes from rejected to inconclusive under the preregistered rule — the point estimate is a 19% reduction, but the interval's upper end (−0.08) does not lie wholly below the threshold (−0.13); H2 in Port Halvard unchanged (supported); H4 unaffected (customer-hours do not depend on weights). Explanation: with predeclared weights, F3 first protects two heavily weighted services (water 4 and the hospital via water 5), which favours CRITFLAG's order; with equal weights, restoring telecom early matters relatively more and DEP's earliest-time-to-impact rule gains. Conclusion: the Riverbend verdict depends on values; the thesis must report verdicts by weight set.

EX044 — Limitations section. A strong answer resembles §7.7, with five or more limitations each given effect, direction and resolving study, and ranks them: (1) human buffers omitted (could reduce all reordering benefits), (2) synthetic regions (frequency of divergence unknown), (3) weights (verdicts change), (4) travel time (reduces DEP benefit where critical feeders are dispersed), (5) tabletop scale (adoption unproven).

EX045 — Claim audit. The original output flags K2, K3 and K4 (see §8.1.1). K5 is reported "OK" because none of the keywords appear. Improved check: extend OVERREACH with phrases such as "the grid", "resilient to", "makes", "secure", or better, require an explicit scope phrase ("in the synthetic…") in the text of any claim whose scope field contains "synthetic". Corrected K5: "In two synthetic regions, time-to-impact restoration ordering reduced modelled critical-service loss after distribution outages under stated conditions; it does not prevent cyber attacks, and its effect on real grids is untested."

EX046 — Examiner question bank. Hardest three for the Cascade Study, with model answers: (1) "Isn't the result circular?" — answer with the mismatch and independent-modeller evidence and admit what remains circular (ORACLE and DEP still share the model). (2) "Why should anyone accept your weights?" — they shouldn't without scrutiny; describe elicitation and the verdict-by-weight-set table; weights are a policy input that the method makes explicit. (3) "Without a field study, what do you know about real utilities?" — that the conditions for benefit are measurable; that the divergence survey is the next study; that no field claim is made. A real gap revealed: the thesis has no evidence on whether crews can follow a reordered plan given travel times — a gap in the work, to be stated as a limitation.

EX047 — Publication plan. As in §8.3.1, with: the T0 archive v1.0 released with paper 1; papers 2–4 citing archive versions; the dual-use review and sector coordination completed before any preprint of paper 2; partner notice periods respected for papers using elicitation ranges; and a statement in each paper of its scope relative to the thesis's overall claim.

EX048 — Disclosure routing.

Lesson table; scroll horizontally to read all columns →

Finding Kind Route and timing Published
(a) Partner exposes its critical-customer list Organization-specific Immediate private report under the data-use agreement; confirm fix Never in identifiable form; possibly a general note that priority lists need access control
(b) Unsigned configuration imports in a commercial product Product vulnerability CVD with the vendor, directly or via a coordinator; publication after remediation or under the coordinator's policy Advisory-level description after coordination
(c) Paper versus physical buffer inventories Organization-specific and sector-level Private reports to each partner; then general publication of the gap Aggregate finding without identities
(d) Single repeater site for crew radios Organization-specific with sector relevance Private report to the utility; general finding on single points of failure in restoration communications after coordination General finding only

EX049 — Policy brief. A strong brief opens with the problem (restoration order determines which critical services fail), states four recommendations with confidence levels and evidence links (§8.5), includes a paragraph "What this research does not show" (effects in real utilities, frequency of divergence, adoption under stress, any cyber-prevention effect), uses plain language, and links to the thesis and the T0 archive. Every sentence is marked; sentences that cannot be traced to the thesis are removed.

EX050 — Post-doctoral research program. As in §8.6: (1) divergence survey — claim "divergence occurs in at least a quarter of surveyed utilities", design under T3 protection, partner model via sector associations, decision changed: whether to promote time-to-impact ordering at all; (2) human-buffer modelling — claim "including fuel and water deliveries reduces the modelled benefit of reordering by less than half", validated against after-action records; (3) integrity attacks on planning data — claim "map audits at 98% accuracy limit the consequence amplification of corrupted priority data to a stated bound". Order: (1) first, because if divergence is rare, (2) and (3) matter more than further method work. Stopping result: if the survey finds divergence in very few utilities and map errors are rare, the program should pivot from ordering methods to buffer verification.