◇ OpenCyber Academy
Engineering · Chapter 49 · English

Chapter 49 — Engineering thesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 49 — Engineering thesis

Lesson map

Lesson 49 published. Map, example, EX097.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.3 Generalization"]
  N3["49.4 Integrity"]
  N4["Engineering note"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX097"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.3 Generalization"]
  N3["49.4 Integrity"]
  N4["Engineering note"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX097"]

[Learning outcomes]
    |
    v
[49.1 Structure]
    |
    v
[49.3 Generalization]
    |
    v
[49.4 Integrity]
    |
    v
[Engineering note]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX097]

Learning outcomes

You will (1) write an engineering thesis that documents the design, implementation and validation; (2) present results with uncertainty and limits; (3) generalize lessons responsibly; and (4) meet academic integrity standards. It synthesizes the capstone.

49.1 Structure

Introduction (problem, stakeholders, contribution); background (quantum threat, standards, hybrids, agility); requirements; design and alternatives; implementation; verification and validation; operations and failure trial; discussion (lessons, generalization, limits); conclusion and future work. Optionally include an applied study (Chapter 42).

The structure mirrors the engineering lifecycle so readers can find each part where they expect it. Examiners often read the discussion of limits first, so it must state what the work did not show, such as certificate migration on the public portal. The optional study fits naturally where it informs a design or measurement choice, like the telemetry comparison that changed BPA's dashboard.

49.2 Results and limits

Report measured results with windows and intervals; state residual risks; describe limits with direction (e.g. "passive telemetry cannot see certificate algorithms in TLS 1.3, so certificate migration status is from configuration only").

Stating the direction of a limit tells readers which way the error goes: certificate status from configuration may overstate migration, because a configured certificate might not be served to all clients. Intervals show how much the measured figures could vary. A thesis that reports both is easier to trust than one with only point values.

49.3 Generalization

Lessons that generalize: inventory first; hybrid key exchange early; authentication by trust-anchor lifetime; agility measured; partners set pace. Lessons that may not: specific failure rates, vendor behaviours, BPA's dependency structure.

Separating the two lists helps readers in other organizations decide what to borrow. A hospital or utility can apply inventory-first planning and measured agility directly, but its failure rates and vendor problems will differ from BPA's. The thesis says which lessons depend on context and what would need checking elsewhere.

49.4 Integrity

Cite standards and research accurately; distinguish your work from team work; label synthetic data; do not disclose host confidential information.

Labelling synthetic data protects readers from treating BPA's figures as measurements of a real port. Distinguishing individual from team work matters in a programme where many people contributed. Accurate citation means quoting the standard's numbers, such as the 1,184-byte ML-KEM-768 key, rather than a secondary source's rounding. Confidential host information, such as partner names or unpatched weaknesses, stays out of the thesis even when it would make an example more vivid.

49.5 Worked example

A model thesis abstract: "This thesis designs and validates a quantum-resistant migration for a synthetic port authority's partner ecosystem. Hybrid X25519MLKEM768 key exchange reached 71% of edge connections without exceeding the failure budget; partner VPNs used ML-KEM additional exchanges or interim pre-shared-key mixing; bills of lading were dual-signed with ML-DSA-65 and ECDSA with timestamp renewal; a policy-driven design switched the preferred hybrid group in three days. Certificates on the public portal remain classical; residual risks and generalizable lessons are discussed."

The abstract states one result per area.

49.6 Common errors and limits

One port's experience cannot establish failure rates for all organizations, so claims must be scoped to the case. Omitting residual risks, such as the classical portal certificates, overstates the outcome. Unlabelled synthetic data may be mistaken for field measurements and quoted elsewhere as fact. Each of these is checked by the thesis supervisor before submission, using the residual-risk statement and the data labels in the evidence dossier as the references.

Engineering note

Write the thesis so that a practitioner at another organization can reuse it. Include the requirement templates, the CBOM schema, the policy allow-list format and the test plans as appendices, with synthetic examples. Reusable artefacts multiply the value of the work and are often what examiners and employers remember. Keep confidential details out, and label every number that comes from the synthetic BPA case.

Exercises

Synthesis

The thesis records a validated design with honest results and limits and separates general lessons from local ones.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →