Chapter 50 — Final defense | Engineering Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 50 — Final defense

Lesson map

Lesson 50 published. Map, example, EX099.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["50.1 What examiners test"]
  N2["50.2 The presentation"]
  N3["50.3 Question families"]
  N4["50.4 Honest answers"]
  N5["50.5 After the defense"]
  N6["50.7 Practical activity"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX099"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["50.1 What examiners test"]
  N2["50.2 The presentation"]
  N3["50.3 Question families"]
  N4["50.4 Honest answers"]
  N5["50.5 After the defense"]
  N6["50.7 Practical activity"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX099"]

[Learning outcomes and connection]
    |
    v
[50.1 What examiners test]
    |
    v
[50.2 The presentation]
    |
    v
[50.3 Question families]
    |
    v
[50.4 Honest answers]
    |
    v
[50.5 After the defense]
    |
    v
[50.7 Practical activity]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX099]

Learning outcomes and connection

After this chapter you can (1) prepare a technical defense presentation of a capstone and thesis; (2) anticipate examiner questions by family and prepare evidence-based answers; (3) handle questions you cannot answer honestly; and (4) plan corrections and handover after the defense. It closes the course.

50.1 What examiners test

Examiners check that the candidate understands the need and constraints; made defensible design decisions; verified claims competently; knows the limits of the evidence; and can reason about changes ("what if the requirement were 2 h?"). They read the thesis closely and probe inconsistencies.

For the TMRP defense, examiners are likely to probe the R6 shortfall and the accepted residual risk D1. They may ask what would change if the hospital buffer were two hours instead of four, and the candidate should reason from the fault tree and the local automatic mode rather than guess.

50.2 The presentation

Twenty minutes: need and consequence (2 min); requirements (2); alternatives and selection (3); architecture and key controls (4); verification and validation results with failures and fixes (5); requirement status and residual risks (2); limitations and next steps (2). One message per slide. Show the requirement-status table; examiners respect "not met" stated plainly.

For TMRP, the requirement-status table would show R1, R2 and R7 as met after fixes and R6 as not met at twelve hours, with the options in ADR-015. That slide prepares the panel for the questions in the worked example, and stating the shortfall before an examiner finds it earns more trust than any polished result.

50.3 Question families

Need: why does this matter, to whom, how do you know?
Design: why this and not that alternative; what would change your choice?
Analysis: where does this number come from; what if this assumption is wrong?
Verification: how do you know the test tests the requirement; what did your tests miss?
Limits: what can you not claim; what would a field deployment reveal?
Ethics and safety: what could go wrong for people; who owns the residual risk?

Prepare two answers per family with references to the dossier.

50.4 Honest answers

When you do not know: say so, say how you would find out, and — if you can — reason toward an answer aloud, labelled as reasoning. Do not invent numbers. When an examiner finds an error: acknowledge, assess its impact on the claims, and propose a correction.

In the worked example, the candidate does this when asked about residual risk D1: the candidate states who accepted it, the evidence that bounds it and the alternative that would remove it, without pretending the risk is negligible. No number is invented.

50.5 After the defense

Corrections are listed in a table: examiner request, change made, location. Hand over the artefact and dossier to the sponsor with known limitations and maintenance needs. For real projects, route any security findings through the owner's processes.

For TMRP, the handover goes to LRWA's operations director with the dossier, the open item on R6 and the note that the stale-station threshold needs re-tuning on site. Any security finding about real equipment would go through LRWA's own processes, not the thesis.

50.6 Worked example: answering a hard question (synthetic)

Examiner: "Your assurance case accepts residual risk D1 — a compromised SCADA centre issuing authentic commands. Why is that acceptable for a hospital supply?" Candidate: "It is accepted by the operations director, not by me, and the case states why: local bounds (R3) keep any accepted setpoint within safe limits, so the worst a compromised centre can do at PS4 is stop the pumps, and the fault tree shows that losing supply then also needs the reservoir path and the hospital tank to fail. If the examiners consider that insufficient, the alternative in ADR-012 — local-only setpoint writes at PS4 — removes remote control at that site for an estimated staffing cost of one call-out per month. I would not claim D1 is negligible; I claim it is bounded and owned."

50.7 Practical activity

Hold a mock defense with two peers acting as examiners using the question families; record questions you could not answer and prepare answers.

Ask your examiners to use every question family and to probe at least one number in your thesis. Record each question you could not answer, then trace the answer to your dossier afterwards. For TMRP, the hardest questions concern the R6 shortfall and residual risk D1; prepare those answers until you can give them briefly, with the evidence named, and without claiming more than the dossier supports.

50.8 Common errors and limits

Presentations that hide failures.
Defensive answers to error findings.
Invented numbers under pressure.
No correction plan.

The TMRP candidate avoids these by showing the R6 shortfall on a slide, acknowledging errors plainly, refusing to invent numbers and keeping a corrections table ready for the examiners' requests. Failures such as the restart replay are presented as findings that verification caught, with the fix and the re-test, which is exactly what examiners want to see. A corrections table is ready. Every claim stays within the dossier.

Exercises — chapter 50

EX099 — Question bank. Objective: anticipate examination. Inputs: your thesis or the TMRP case. Steps: write twelve questions (two per family) and short evidence-based answers with dossier references. Expected evidence: bank. Rubric: 3 = hard, specific questions with honest answers including limits; 2 = soft questions; 1 = answers without evidence; 0 = none.

EX100 — Corrections table. Objective: plan corrections. Inputs: examiner requests: (1) report the variability of recovery time; (2) justify the 0.6 usable battery fraction; (3) remove the claim that the detector "prevents" attacks. Steps: write a corrections table with change, location and how each is evidenced. Expected evidence: table. Rubric: 3 = (1) acknowledges single trial and adds plan or repeated simulated runs, (2) adds manufacturer source or sensitivity, (3) rewording to "detects"; 2 = one weak; 1 = no locations; 0 = none.

Chapter synthesis

The defense tests understanding, judgement and honesty about limits. Present need, design, evidence and status plainly; prepare by question family with dossier references; answer what you know, reason transparently about what you do not, and turn examiner findings into a precise corrections table and a responsible handover.

Continue studying — chapter 50 of 50

← Chapter 49 · Course chapter index · Next course via chapter index →

This is the final chapter of this course; the index links the next course in the full study path.