◇ OpenCyber Academy
Doctoral research · Chapter 8 · English

Chapter 8 — Defense and publication plan

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Defense and publication plan

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Preparing the defense"]
  N2["8.2 Answering examiners"]
  N3["8.3 Publication plan"]
  N4["8.4 Practitioner dissemination"]
  N5["8.5 After the doctorate"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Preparing the defense"]
  N2["8.2 Answering examiners"]
  N3["8.3 Publication plan"]
  N4["8.4 Practitioner dissemination"]
  N5["8.5 After the doctorate"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX045"]
[Learning outcomes]
    |
    v
[8.1 Preparing the defense]
    |
    v
[8.2 Answering examiners]
    |
    v
[8.3 Publication plan]
    |
    v
[8.4 Practitioner dissemination]
    |
    v
[8.5 After the doctorate]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) prepare a defense around the strongest objections; (2) answer examiners with evidence and concession; (3) plan publication venues and order; (4) plan dissemination to practitioners without overstating results.

8.1 Preparing the defense

Amara prepares by writing the ten hardest questions she expects, drawn from the revision table and her own doubts, and drafting evidence-based answers. Examples include why a single organisation, why not randomise, how coding reliability affects the estimate and what would change her mind. She rehearses with colleagues instructed to interrupt. Prof. Quintero advises that the defense is not a performance of certainty but a demonstration that she knows the boundaries of her evidence. Preparation turns anxiety into a list of specific, answerable questions, each linked to a section of the thesis.

8.2 Answering examiners

During the defense an external examiner argues that difference-in-differences cannot exclude unobserved shocks hitting only adopting teams. Amara agrees that it cannot exclude them completely, explains the quarterly log of concurrent changes and the sensitivity analysis, and proposes the test that would settle it: a future study with randomised wave order. A second examiner asks whether ninety minutes per change is worth a fifth fewer defects. She answers that this is a decision for each organisation and gives the inputs needed to make it. Concession where evidence is limited makes the remaining claims more credible.

8.3 Publication plan

She plans three outputs. The main study goes to a peer-reviewed empirical software engineering or security venue with the replication package. The coding manual and agreement study go to a workshop or journal focused on measurement. The pilot lessons go to a practitioner venue. She orders submissions so that the measurement paper, on which the others depend, appears first, and she cites the archive identifier in each. She agrees with Tessaro which details will be anonymised in all outputs and gives them the same advance review right as during the thesis.

8.4 Practitioner dissemination

Practitioners read summaries, not theses. Amara writes a two-page brief stating the finding in plain terms: at one insurer, adding a ninety-minute threat-modelling step to design review was associated with about a fifth fewer post-release architecture defects. It lists the conditions, costs and uncertainties, and links to the protocol and checklist. She declines a vendor's invitation to present the result as proof that its threat-modelling tool works, because her study did not test any tool. Careful dissemination protects both the research and the practitioners who might act on it.

8.5 After the doctorate

Amara records future work: a randomised-wave replication, a multi-organisation study across industries, measurement of design quality beyond defects and study of how threat modelling interacts with zero trust architectures under SP 800-207. She offers her coding manual to other researchers and agrees to review a replication proposal. Her final reflection notes that the most valuable skill learnt was not a statistical method but the habit of asking, for every claim, what observation would show it false and whether that observation had been sought. She intends to keep that habit in every future project.

Worked example

Amara rehearses ten hard questions, concedes the unobserved-shock limit with a proposed randomised replication, orders three publications with the measurement paper first and declines a vendor endorsement.

Synthetic case. Examiners, venues and the vendor invitation are synthetic; SP 800-207 is real.

Errors and limits

Publication timelines are uncertain; plans should not delay sharing the archive. Practitioner briefs lose nuance and must link to full limitations.

Exercises

Synthesis

A defense and publication plan succeed when they concede real limits, sequence outputs by dependency and refuse to let results be overstated.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →