Chapter 49 — Engineering thesis | Engineering Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 49 published. Map, example, EX145.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 Claim"]
  N2["49.2 Body"]
  N3["49.3 Citations"]
  N4["49.2b Threats to validity"]
  N5["49.3b Reproducibility appendix"]
  N6["49.1b Related work honesty"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX145"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 Claim"]
  N2["49.2 Body"]
  N3["49.3 Citations"]
  N4["49.2b Threats to validity"]
  N5["49.3b Reproducibility appendix"]
  N6["49.1b Related work honesty"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX145"]

[Learning outcomes]
    |
    v
[49.1 Claim]
    |
    v
[49.2 Body]
    |
    v
[49.3 Citations]
    |
    v
[49.2b Threats to validity]
    |
    v
[49.3b Reproducibility appendix]
    |
    v
[49.1b Related work honesty]
    |
    v
[Practice note]
    |
    v
[Worked example] --> [Exercise EX145]

Learning outcomes

You will (1) structure a thesis around a platform claim; (2) defend measures and limits; (3) cite primary frameworks correctly.

49.1 Claim

One sentence: what you built/measured and for whom. Example: "Signed policy distribution with fail-closed semantics reduces unauthorized allows in synthetic trials."

One sentence that names what was built or measured and for whom keeps the thesis from wandering into tool marketing. The signed-policy example is the shape Sam used. Examiners read that sentence first and judge every chapter against it. Chapters that do not serve that sentence are cut in advisor review. Cut chapters are listed in the advisor notes so the student sees why.

49.2 Body

Related work (SP 800-115, PTES, ATT&CK, Albrecht & Jensen), design, verification, results with intervals, limitations, ethics.

Intervals belong with results so empty single scores cannot dominate. Sam's results chapter leads with deny-all times and confidence notes before any qualitative praise. Qualitative praise without numbers is moved to an appendix or deleted. Appendices that only praise tools without data are removed before submission. Data-free praise is a common draft habit and is caught in advisor review. Each results table states the number of trials and the dates they ran.

49.3 Citations

Use the verified URLs/DOIs from the source policy; do not invent papers. Frameworks change — note access dates.

Synthetic case — Riverstone Transit. Thesis draft used only synthetic trial data and cited CBEST 2024 Implementation Guide correctly.

Invented papers fail a viva quickly. Verified URLs/DOIs with access dates keep framework claims checkable when editions move. Sam's CBEST 2024 cite includes the access date and the exact guide title from the source policy list. Access dates older than a year trigger a re-check before submission. Re-checks update the access date in the same commit as the bibliography.

49.4 Errors and limits

A thesis that evaluates exploitation skill is out of programme scope.

Exploitation skill as a thesis outcome is outside the programme and the safety boundary. Platform measurement and fail-closed design are in. Sam's advisor returns proposals that grade red-team cleverness instead of authorized engineering evidence. Cleverness metrics are listed as non-goals in the proposal and enforced at defense. Defense slides that show exploit skill demos are stopped by the chair. The chair's stop is practised in rehearsal with a planted exploit slide.

49.2b Threats to validity

Discuss construct validity (does coverage measure what you claim?), internal validity (confounds in the trial), external validity (other orgs). A thesis that skips this section overclaims by omission.

Coverage must be defended as planned-technique coverage, not residual risk. Sam's threats-to-validity part states that one transit host and synthetic injects limit generalization to other sectors. Sector limits are stated in the abstract, not only buried in chapter nine. Abstract and chapter nine are linted to contain the same limit sentence. Each threat is paired with what was done to reduce it or why it could not be reduced.

49.3b Reproducibility appendix

Ship enough to replay synthetic trials: fixture hashes, tool SHAs, scripts. "Available on request" is not a reproducibility appendix for an engineering thesis in this programme.

Fixture hashes, tool SHAs and scripts in the appendix beat "available on request." A sceptical reader should replay the synthetic trial. Sam's appendix lists TrackScope SHA, fixture pack hash and the one-line commands that reproduced the ≤30s deny-all measure. Commands are copied from CI, not retyped from memory, so they stay accurate. CI copy-paste includes the image digest the commands expect.

49.1b Related work honesty

Cite frameworks you actually used. Padding related work with unread papers is discovered quickly in defense questions. Thin and accurate beats thick and fake.

Unread citations collapse under defense questions. Sam cites SP 800-115, PTES, ATT&CK and Albrecht and Jensen because each appears in a design or measurement choice he can point to. A framework named in related work but unused in design is removed. Removal is preferred to a vague "inspired by" claim. Each citation names the edition or version that was used.

Practice note

Examiners receive a one-page threats-to-validity summary. If you cannot fit honesty on one page, the thesis overclaims elsewhere. Length is not rigor; structured limits are.

Put the claim sentence in bold on page one so examiners and you share the same target.

Related-work claims require a one-line how-used note, not only a citation.

How-used notes stop citation padding cold in advisor review.

The threats-to-validity page is graded; leaving it blank fails the thesis gate regardless of implementation quality.

Examiners read that page first.

49.4b Structure of the argument

Sam's thesis states its claim in the first paragraph, presents evidence in the order a sceptical reader would demand it, and ends each chapter by stating what that chapter established and what remains uncertain. His advisor's test is whether the abstract alone tells a reader exactly what was shown.

Ending each chapter with what was established and what remains uncertain trains the abstract to be precise. Sam rewrote his abstract three times until it named the deny-all measure and the single-host limit without adjectives. Adjectives such as robust and seamless are banned from the abstract by the same lint as UI copy. The abstract lint runs in CI on the thesis Markdown.

Exercises

EX145 — Claim. Write a one-sentence thesis claim for dual-approval. Rubric: 3 = measurable+scoped; 2 = vague; 1 = exploit claim; 0 = none.
EX146 — Limit. One limitation paragraph (3 sentences). Rubric: 3 = external validity clear; 2 = partial; 1 = none; 0 = overclaim.
EX147 — Cite. Give the DOI for NIST SP 800-115. Rubric: 3 = 10.6028/NIST.SP.800-115; 2 = title only; 1 = wrong; 0 = none.

Synthesis

One claim, honest limits, real citations.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →