Chapter 7 — Thesis synthesis and reproducibility archive
Lesson map
Lesson 07 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Synthesis"]
N2["7.2 Reproducibility archive"]
N3["7.3 Protecting sensitive material"]
N4["7.4 Writing the limitations"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Synthesis"]
N2["7.2 Reproducibility archive"]
N3["7.3 Protecting sensitive material"]
N4["7.4 Writing the limitations"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX039"]
[Learning outcomes]
|
v
[7.1 Synthesis]
|
v
[7.2 Reproducibility archive]
|
v
[7.3 Protecting sensitive material]
|
v
[7.4 Writing the limitations]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) synthesise studies into a coherent thesis; (2) build a reproducibility archive; (3) protect sensitive material in archived research.
7.1 Synthesis
Yusuf's thesis combines three studies: the measurement pilot on excess privilege, the patch latency study and an access review study analysed the same way, which found a clearer reduction in excess privilege in adopting departments. His synthesis argues that risk-ranked practices are associated with improvements whose size varies by outcome and that measurement design strongly affects what can be detected. He organises chapters around these claims rather than chronologically, so each chapter supports a stated part of the argument. Each claim cites its supporting study.
7.2 Reproducibility archive
Yusuf builds an archive containing the pre-registration, frozen analysis scripts, synthetic datasets that reproduce every reported figure, a description of real data structures without real values and a README explaining how to rerun each analysis. He computes SHA-256 checksums for every file using Python's hashlib and lists them in a manifest, so examiners can confirm nothing changed after submission. The archive is deposited in the university repository with a persistent identifier. A colleague in another department follows the README on a clean machine and reproduces every figure, which confirms the archive is complete enough for examiners and later readers.
7.3 Protecting sensitive material
Because the work concerns a real type of organisation's security, Yusuf removes anything that could aid an attacker: system names, software versions, network details and department codes are replaced with generic labels. Fernvale's security lead reviews the archive and the thesis, as the ethics condition required, and asks him to remove a figure showing the slowest-patched system category. He replaces it with an aggregated chart. Prof. Hald notes that openness and security must be balanced deliberately in security research. The security lead approves the revision.
7.4 Writing the limitations
Yusuf writes limitations plainly: one organisation, low power for patch latency, possible catching-up effects, measures limited to operational logs and synthetic data in the public archive that mirror structure but not exact distributions of real data. For each limitation, he states how it affects the claims. He notes that limits sections in security research often understate organisational context, and he describes Fernvale's size, sector and regulatory environment so readers can judge transferability. Prof. Hald checks that each limitation is matched by a specific consequence for the conclusions, and Yusuf removes vague phrases that do not say what they limit.
Worked example
Yusuf synthesises three studies around claims, archives pre-registration, scripts, synthetic data and checksummed manifests, removes attacker-useful details after security lead review and writes concrete limitations with context.
Synthetic case. The thesis and archive are synthetic.
Errors and limits
Archiving real system names and versions can expose the partner to attack.
Exercises
- EX039 — Third study. What did the access review study find? Rubric: 3 = a clearer reduction in excess privilege;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX040 — Checksum tool. Which module computes the checksums? Rubric: 3 = hashlib;; 2 = partly correct;; 1 = other;; 0 = none.
- EX041 — Removed figure. What figure did the security lead ask to remove? Rubric: 3 = the slowest-patched system category;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX042 — Generic labels. What details become generic labels? Rubric: 3 = system names, versions, network details and department codes;; 2 = most;; 1 = few;; 0 = none.
- EX043 — Archive data. What data does the public archive contain? Rubric: 3 = synthetic data reproducing reported figures;; 2 = partly correct;; 1 = real;; 0 = none.
- EX044 — Transferability aid. How does Yusuf help readers judge transferability? Rubric: 3 = describes Fernvale's size, sector and regulation;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 07 (chapter 07 of 08)
← Chapter 06 · Course chapter index · Chapter 08 →
Continue to the next authored lesson.