Chapter 8 — Defense and publication plan

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 The defense"]
  N2["8.2 Questions"]
  N3["8.3 Ethics questions"]
  N4["8.4 Publication plan"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 The defense"]
  N2["8.2 Questions"]
  N3["8.3 Ethics questions"]
  N4["8.4 Publication plan"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]

[Learning outcomes]
    |
    v
[8.1 The defense]
    |
    v
[8.2 Questions]
    |
    v
[8.3 Ethics questions]
    |
    v
[8.4 Publication plan]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) defend a GRC thesis before examiners; (2) answer questions on method, ethics and practice; (3) plan publications and practical outputs.

8.1 The defense

Amara presents for thirty minutes: the governance problem, the gap, the randomised design, results with uncertainty, the replication and the limits. She shows the six-scenario model as a quick intuition for why matrices can mislead, followed by real study results to show how much this matters in practice. The examiners are a risk scientist, an information security governance professor and a hospital chief information security officer, chosen to cover theory, standards and practice. Each examiner received the archive two weeks before the defense day.

8.2 Questions

The risk scientist asks whether calibration on short-horizon events tells us anything about rare catastrophic losses. Amara answers that it does not directly; it shows assessors can express uncertainty honestly, which is necessary but not sufficient. The professor asks how the findings fit NIST SP 800-37r2's risk management framework; she explains that the method fits the assess and monitor steps without changing authorisation decisions. The practitioner asks about cost; she cites ninety minutes of training and modest analyst time per scenario.

8.3 Ethics questions

An examiner asks whether quantification could be misused to justify cutting security budgets. Amara agrees this risk exists, especially if wide ranges are reduced to a single optimistic figure. She recommends that boards always see ranges and exceedance probabilities, that assumptions are recorded and that results are reviewed by someone independent of the budget decision. She also notes that matrices can be misused in the same way, by quietly downgrading ratings. Governance, not method, is the main safeguard against motivated risk assessment.

8.4 Publication plan

The examiners pass the thesis with minor corrections. Amara plans three outputs: a journal article on the randomised comparison with the full archive; a shorter practitioner article on board presentation of risk; and a free training module on calibration for public-sector assessors. She will share the synthetic scenario set so that other organisations can run comparable studies. She notes that partial replication was a strength of her work and hopes others will replicate it in sectors beyond health. Each output names its funding and limits.

Worked example

Amara defends her thesis, answers questions on rare events, SP 800-37r2 fit, cost and misuse, and plans three publications.

Synthetic case. The defense is synthetic; SP 800-37r2 is real.

Errors and limits

Examiners have their own views. Publication takes time.

Exercises

• EX045 — Examiner mix. Which three perspectives did the examiners cover?
  Show marking criteria

  Rubric: 3 = theory, standards and practice;; 2 = three;; 1 = vague;; 0 = none.
• EX046 — Rare-event answer. How did Amara answer on rare catastrophic losses?
  Show marking criteria

  Rubric: 3 = calibration is necessary but not sufficient;; 2 = limits;; 1 = proof;; 0 = none.
• EX047 — RMF fit. Where does the method fit in SP 800-37r2?
  Show marking criteria

  Rubric: 3 = the assess and monitor steps;; 2 = assess;; 1 = authorise;; 0 = none.
• EX048 — Misuse safeguard. What safeguards against motivated risk assessment?
  Show marking criteria

  Rubric: 3 = governance with ranges, recorded assumptions and independent review;; 2 = governance;; 1 = method choice;; 0 = none.
• EX049 — Defense outcome. What was the defense outcome?
  Show marking criteria

  Rubric: 3 = pass with minor corrections;; 2 = pass;; 1 = vague;; 0 = none.
• EX050 — Shared resource. What will Amara share for other organisations?
  Show marking criteria

  Rubric: 3 = the synthetic scenario set;; 2 = scenarios;; 1 = real data;; 0 = none.

Synthesis

A defense tests reasoning, ethics and practical value, and publication extends the contribution.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →