Chapter 8 — Defense and publication plan | Doctoral research Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Preparing the defense"]
  N2["8.2 Anticipated questions"]
  N3["8.3 Publication plan"]
  N4["8.4 After the defense"]
  N5["Handling a hard question"]
  N6["Acknowledging contributions"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Preparing the defense"]
  N2["8.2 Anticipated questions"]
  N3["8.3 Publication plan"]
  N4["8.4 After the defense"]
  N5["Handling a hard question"]
  N6["Acknowledging contributions"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes]
    |
    v
[8.1 Preparing the defense]
    |
    v
[8.2 Anticipated questions]
    |
    v
[8.3 Publication plan]
    |
    v
[8.4 After the defense]
    |
    v
[Handling a hard question]
    |
    v
[Acknowledging contributions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) prepare the defense; (2) anticipate questions; (3) plan publications.

8.1 Preparing the defense

Ines prepares a forty-minute talk: problem, contributions, methods, results, limits and implications. She rehearses with colleagues playing examiners and records the hardest questions. Each slide carries one claim and its evidence.

Preparing for the defense, Ines rereads the whole thesis, notes its weakest points, and prepares concise explanations for each. She practises a short opening summary that states the question, approach, main findings and contribution in a few minutes. A mock defense with colleagues playing examiners exposes unclear answers and gives her practice staying calm under sustained questioning.

8.2 Anticipated questions

Examiners are likely to ask about causation, generalisation beyond the sector, the cost of the procedure and why incidents were not measured. Ines prepares short, honest answers: the design supports association and a controlled before-after comparison, not broad causation; the sector limit is real; review costs are reported; incident data were too sparse and sensitive to analyse.

She practises answering each one concisely, with evidence.

Questions she cannot answer fully are acknowledged honestly, with what further work would settle them.

8.3 Publication plan

Two papers are planned: the replication and codebook for a measurement venue, and the intervention study for a practitioner-oriented security venue, both with the synthetic archive. A short practitioner guide based on the procedure is offered to the partners and published openly.

The publication plan identifies which chapters can become journal or conference papers, the likely venues, and the order of submission. Ines checks that data agreements permit each publication, involves partners in reviewing drafts, and plans to release the codebook and synthetic data alongside the papers so other researchers can build on the work.

8.4 After the defense

Ines plans to extend the study to organisations moving toward zero trust, testing whether rule hygiene affects the transition, a gap identified in chapter 2.

After the defense, Ines makes any corrections the examiners require, records each change, and submits the final thesis. She then sends partners a short summary of findings written for practitioners, closes the data agreement by deleting or returning partner data as promised, and archives her own records. Finally, she reflects on what she would do differently, which helps her supervise or advise future students on similar projects.

Handling a hard question

Some questions cannot be fully answered, and examiners often ask them deliberately to see how a candidate reasons. Ines practises a three-step response: restate the question to confirm she understands it, say what her evidence does show, then say plainly what it cannot show and how a future study could address it. For example, asked whether the procedure would work in a large cloud provider, she explains that her partners managed hundreds of rules per firewall rather than tens of thousands of security group rules, that the procedure's steps would likely still apply, and that scaling would need automated owner lookup, which she has not tested.

Acknowledging contributions

The thesis acknowledgements name the partner engineers who gave time to interviews and reviews, the second coder and the colleague who reproduced the archive, with their permission. Ines also records in the methods chapter exactly what each person contributed, which is good research practice and makes clear which work is hers. Partners receive a summary of the results before publication, with time to raise concerns about anything that could identify them. This keeps trust with organisations that took a risk by sharing sensitive configurations, and makes future collaborations more likely.

Worked example

At the defense, examiners ask about the comparison group's improvement; Ines explains it and shows the difference-in-change estimate.

Synthetic case. The defense is synthetic.

Errors and limits

Overclaiming at a defense invites challenges that undermine sound results.

Exercises

EX045 — Talk structure. List six parts of the defense talk.
Show marking criteria
Rubric: 3 = six;; 2 = five;; 1 = fewer;; 0 = none.
EX046 — Causation answer. Answer the causation question briefly.
Show marking criteria
Rubric: 3 = association plus controlled comparison, limits;; 2 = partial;; 1 = overclaim;; 0 = none.
EX047 — Incidents answer. Why were incidents not measured?
Show marking criteria
Rubric: 3 = sparse and sensitive data;; 2 = unavailable;; 1 = vague;; 0 = none.
EX048 — Venue choice. Why split into two papers?
Show marking criteria
Rubric: 3 = different audiences and contributions;; 2 = two topics;; 1 = vague;; 0 = none.
EX049 — Future work. Name the planned future study.
Show marking criteria
Rubric: 3 = zero trust transition and rule hygiene;; 2 = zero trust;; 1 = vague;; 0 = none.
EX050 — Practitioner guide. Why publish a practitioner guide?
Show marking criteria
Rubric: 3 = make procedure usable;; 2 = share;; 1 = vague;; 0 = none.

Synthesis

The thesis closes with honest claims, a reproducible archive and a clear publication path.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →