Chapter 49 — Engineering thesis | Engineering Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 49 — Engineering thesis

Lesson map

Lesson 49 published. Map, example, EX145.

flowchart TD
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.2 The argument"]
  N3["49.3 Literature"]
  N4["49.4 Trade-offs"]
  N5["49.5 Limitations"]
  N6["49.6 Style"]
  N7["49.7 Practitioner value"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX145"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["49.1 Structure"]
  N2["49.2 The argument"]
  N3["49.3 Literature"]
  N4["49.4 Trade-offs"]
  N5["49.5 Limitations"]
  N6["49.6 Style"]
  N7["49.7 Practitioner value"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX145"]

[Learning outcomes]
    |
    v
[49.1 Structure]
    |
    v
[49.2 The argument]
    |
    v
[49.3 Literature]
    |
    v
[49.4 Trade-offs]
    |
    v
[49.5 Limitations]
    |
    v
[49.6 Style]
    |
    v
[49.7 Practitioner value]
    |
    v
[Worked example] --> [Exercise EX145]

Learning outcomes

You will (1) write an engineering thesis that presents problem, design, implementation and evaluation; (2) discuss trade-offs and limitations; (3) relate the work to literature and practice; (4) write clearly for examiners and practitioners.

49.1 Structure

Introduction and problem; background and literature; requirements; design and alternatives; implementation; verification and validation; operation and reliability; discussion; limitations; conclusions; references; appendices.

The structure mirrors the engineering process, so readers can follow the work in the order it happened. Separating discussion from results keeps interpretation apart from measured facts. Limitations get their own chapter, which gives them proper weight rather than hiding them in the conclusion. References and appendices hold detail that would slow the main text, such as full test tables and the review log, so the chapters stay readable for both examiners.

49.2 The argument

Amara's thesis argues that a small SOC can close a network-monitoring gap in agentless depots using existing firewalls, measured requirements and staged validation, at low cost and without disrupting operations.

A thesis needs a claim that the evidence can support or refute. Amara's names the context, the method and the outcomes, so each part can be checked against the dossier. 'Low cost' and 'without disrupting operations' are supported by CPU measurements, the absence of dispatch outages and the reuse of existing firewalls.

49.3 Literature

Knerler, Parker and Zimmerman (2022) for SOC strategy; NIST SP 800-92 for log management; ATT&CK for technique coverage; Alahmadi et al. (2022) for alarm quality; Sundaramurthy et al. (2014) for analyst practice.

Each source supports a specific part of the argument: SOC strategy for the overall approach, log management guidance for the pipeline, ATT&CK for coverage, alarm-quality research for alert design and analyst studies for the playbook. Citing them where they are used, rather than in a general list, shows how each shaped the work.

49.4 Trade-offs

Logging only connection starts at two depots saved CPU but lost duration data; device continuity was shown as context rather than filter; volume was controlled by tiering.

Naming trade-offs shows the design was chosen, not just built. Losing duration data at two depots saved firewall load but limits some investigations there. Showing device continuity as context keeps analysts' judgement in the loop. Tiering controlled volume while keeping data available for longer investigations. Amara explains each with the figures that justified it, so examiners can weigh the choice themselves.

49.5 Limitations

One organisation; synthetic and anonymised data; short operation period; simulations chosen by people who knew the design.

Each limitation narrows how far the results can be generalised. One organisation may have unusual traffic; synthetic data may lack real oddities; a short period may hide slow problems; simulations by people who knew the design may be easier to catch than real attacks. Stating them lets readers judge the evidence fairly. She also notes which limitation would matter most to another SOC trying to reuse the approach, and what evidence would reduce it.

49.6 Style

Plain language, defined terms, figures with units, numbered requirements matched to evidence IDs.

Plain language makes the thesis accessible to both examiners. Defined terms prevent confusion between similar words, such as verification and validation. Units on every figure avoid misreadings. Matching requirement numbers to evidence IDs lets a reader check any result in a few seconds. Amara asks a classmate outside security to read two chapters and mark any sentence they had to read twice. Those sentences are rewritten. Acronyms are spelled out on first use in each chapter.

49.7 Practitioner value

A short appendix gives a reusable checklist for other SOCs with agentless sites.

A checklist distils the project into steps they can follow: confirm boundary logging, link an approved list to inventory, test with timed injections, validate with purple-team simulations. It turns a thesis into something useful beyond the university. Each item names the evidence that showed it mattered at Lindqvist, so readers can judge whether it applies to their own sites. The checklist fits on one page and avoids product names, which keeps it useful regardless of tools.

Writing schedule

Amara drafts method and results chapters during the capstone while details are fresh, leaving introduction and discussion until results are final. Her tutor reviews one chapter every two weeks. Figures are generated by scripts stored with the dossier, so a corrected number updates every figure consistently rather than by hand.

Ethics statement

The thesis states that no real customer data appears in it and that all operational figures were approved for release by Lindqvist.

Worked example

Her tutor asks her to cut the background chapter by a third and expand the discussion of what failed — the first latency verification and the silent-source delay — because examiners value learning from failure.

Synthetic case. The thesis is invented.

Errors and limits

A thesis describes one project; generalisation needs other sites.

Exercises

EX145 — Thesis argument. State the thesis's central argument. Rubric: 3 = small SOC closes agentless depot gap with existing firewalls, measured requirements and staged validation, low cost; 2 = partial; 1 = vague; 0 = none.
EX146 — Trade-offs. Name two trade-offs discussed. Rubric: 3 = connection-start logging lost duration; continuity as context; tiering (two); 2 = one; 1 = vague; 0 = none.
EX147 — Tutor advice. What did the tutor ask Amara to change, and why? Rubric: 3 = shorten background, expand failures; examiners value learning from failure; 2 = partial; 1 = style; 0 = none.

Synthesis

An engineering thesis tells a clear, evidenced story, discusses trade-offs and failures honestly and serves practitioners too.

Continue studying — chapter 49 of 50

← Chapter 48 (draft) · Course chapter index · Chapter 50 (draft) →