◇ OpenCyber Academy
Master's · Chapter 7 · English

Chapter 7 — Dissertation writing and limitations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Dissertation writing and limitations

Lesson map

Lesson 07 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Structure around the claim"]
  N2["7.2 Writing results plainly"]
  N3["7.3 Specific limitations"]
  N4["7.4 Recommendations proportional to evidence"]
  N5["7.5 Writing about cryptography responsibly"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Structure around the claim"]
  N2["7.2 Writing results plainly"]
  N3["7.3 Specific limitations"]
  N4["7.4 Recommendations proportional to evidence"]
  N5["7.5 Writing about cryptography responsibly"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX039"]

[Learning outcomes]
    |
    v
[7.1 Structure around the claim]
    |
    v
[7.2 Writing results plainly]
    |
    v
[7.3 Specific limitations]
    |
    v
[7.4 Recommendations proportional to evidence]
    |
    v
[7.5 Writing about cryptography responsibly]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) structure a dissertation so each chapter serves the main claim; (2) write limitations that are specific and useful; (3) turn findings into recommendations that respect evidence strength.

7.1 Structure around the claim

Felipe's dissertation opens with one claim: at Briarwood, ACME renewal was associated with substantially fewer expiry incidents per certificate-year than manual renewal, within both ownership strata, and most remaining ACME incidents followed unmonitored renewal failures after infrastructure changes. The literature chapter explains why this question was open; the methods chapter defines units, linking rules and pseudonymisation; the results chapter reports rates, intervals and strata; the discussion interprets them. Dr. Solberg's test for every paragraph is whether removing it would weaken the claim. Paragraphs that fail the test move to appendices or disappear.

7.2 Writing results plainly

The results chapter leads with the primary analysis exactly as registered, then the stratified analysis, then the descriptive change-collision finding. Each table states the unit, the exposure, the number of events and the interval method. Felipe avoids adjectives such as "dramatic" and instead writes numbers with intervals. Where an analysis was added after the pilot, such as the unknown-mode sensitivity check, he labels it. He includes the eight-certificate inventory from Chapter 2 only as an illustration in the background section, explicitly not as evidence.

7.3 Specific limitations

Weak limitations sections list generic caveats. Felipe writes specific ones, each with its likely direction of bias. Tickets under-record short outages fixed before anyone filed a report, which probably under-counts manual incidents more, because manual renewals are often fixed by hand within minutes. Service criticality was not measured, so automated services may be the better-maintained ones, which would exaggerate the ACME advantage. The study covers one health network with one ACME client; organisations using DNS-01 challenges with different infrastructure may see different failure patterns.

7.4 Recommendations proportional to evidence

From strong evidence Felipe recommends automating renewal for certificates that can use it and assigning a named owner to every certificate, because both associations held across strata. From weaker, descriptive evidence he recommends alerting on ACME renewal failures and reviewing certificate dependencies during firewall changes, framed as low-cost measures consistent with the findings rather than proven effects. He also recommends monitoring Certificate Transparency logs, defined in RFC 6962, to discover certificates missing from the inventory, framed as a hypothesis for future work, since his study never measured it.

7.5 Writing about cryptography responsibly

Because readers may skim, Felipe adds a short box clarifying what the study does not say. It does not say certificates or TLS are weak; the failures were operational, and the cryptography behaved as RFC 8446 and RFC 5280 require. It does not recommend extending lifetimes to reduce renewals, which would trade operational convenience for a longer exposure window for compromised keys. And it does not recommend building custom renewal scripts in place of maintained ACME clients, because home-grown tooling would reintroduce exactly the silent failures the study observed.

Worked example

Felipe writes a claim-led dissertation, specific limitations with directions of bias, and recommendations graded by evidence strength, plus a box on what the study does not imply about cryptography.

Synthetic note. Briarwood's findings are invented; RFC 6962, RFC 8446 and RFC 5280 are real.

Errors and limits

Recommending more than the evidence supports is the most common dissertation flaw. Limitations without a direction of bias give readers little help.

Exercises

Synthesis

A claim-led structure, specific limitations and evidence-graded recommendations turn analysis into a dissertation readers can trust and act on.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →