Chapter 49 — Engineering thesis | Engineering Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 49 — Engineering thesis

Lesson map

Lesson 49 published. Map, example, EX145.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.2 Findings"]
  N3["Synthesis"]
  N0 --> N1 --> N2 --> N3
  N3 --> EX["Worked example"]
  EX --> Q["Exercise EX145"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.2 Findings"]
  N3["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> Q["EX145"]

[Learning outcomes]
    |
    v
[49.1 Structure]
    |
    v
[49.2 Findings]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX145]

Learning outcomes

You will (1) write an engineering thesis on a GRC system; (2) combine design, measurement and research; (3) state contributions and limits.

49.1 Structure

Nadia's thesis combines her capstone and applied research. Chapters cover the problem, background and standards, requirements, design and reviews, implementation, verification and failure trials, measurement against criteria, the board-reporting study and conclusions. Each chapter links to dossier evidence. She keeps the main text focused on decisions and results, moving code and detailed test records to appendices. She writes for engineers who might build a similar service and for examiners judging her reasoning. Moving code to appendices keeps the main argument readable for examiners who will not run the scripts.

49.2 Findings

The thesis reports that automated evidence covered nineteen of twenty controls, alerts arrived within hours, owners reported less evidence effort and a failure trial revealed slow tamper detection that was fixed. The board study found more treatment decisions per quarter after ranges replaced the heat map, but a major incident during the period also prompted action, so she cannot separate the effects. She states both findings plainly, with the uncertainty attached to each. The confounding incident is the same threat to validity she recorded when designing the study in chapter 42.

49.3 Contributions and limits

Nadia claims three contributions: a tested design for low-cost continuous control monitoring, evidence that failure trials reveal hidden weaknesses in GRC tooling and a small observational study of board reporting. Limits include one organisation, a short operating period, self-reported effort and a confounded before-and-after comparison. She recommends future work across several utilities. Prof. Brenner notes that stating limits clearly makes contributions more credible, not less. Self-reported effort, for instance, may overstate savings because owners knew the service was her project.

Worked example

Nadia structures her thesis around decisions and results, reports findings with uncertainty and states three contributions with limits.

Synthetic case. The thesis is synthetic.

Errors and limits

One-organisation studies limit generality. Confounding remains.

Exercises

EX145 — Board finding. What did the board study find and why is it uncertain? Rubric: 3 = more decisions, but a major incident also prompted action;; 2 = confounded;; 1 = vague;; 0 = none.
EX146 — Contribution list. Name one of Nadia's three contributions. Rubric: 3 = tested low-cost continuous monitoring design;; 2 = contribution;; 1 = vague;; 0 = none.
EX147 — Thesis limits. List two limits of the thesis. Rubric: 3 = one organisation and short operating period;; 2 = limits;; 1 = vague;; 0 = none.

Synthesis

An engineering thesis links design, measurement and research with clearly stated limits.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →