Chapter 7 — Dissertation writing and limitations | Master's Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 07 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Structure"]
  N2["7.2 Writing findings"]
  N3["7.3 Limitations that protect readers"]
  N4["7.4 Reproducibility appendix"]
  N5["7.5 Practitioner brief"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Structure"]
  N2["7.2 Writing findings"]
  N3["7.3 Limitations that protect readers"]
  N4["7.4 Reproducibility appendix"]
  N5["7.5 Practitioner brief"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX039"]

[Learning outcomes]
    |
    v
[7.1 Structure]
    |
    v
[7.2 Writing findings]
    |
    v
[7.3 Limitations that protect readers]
    |
    v
[7.4 Reproducibility appendix]
    |
    v
[7.5 Practitioner brief]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) structure the dissertation around the research cycle; (2) write findings without exploit detail; (3) state limitations that bound claims; (4) prepare a reproducibility appendix; and (5) draft a practitioner brief.

7.1 Structure

Use: introduction; background (NIST SP 800-115, PTES, ATT&CK, WSTG, TIBER-EU/CBEST); related work; methods; results; discussion; ethics; limitations; conclusion; appendices (templates, pre-registration, synthetic schema). Readers should find the question, measure and answer within five minutes of opening the PDF.

Noah's introduction states the question and the 30-day measure in its first paragraph, and the abstract gives the 62% against 44% result with its conditions. Each chapter answers one stage of the research cycle: background and related work explain the gap; methods give design, measures and ethics; results give the numbers; and the discussion and limitations say what they mean and where they stop. Appendices hold what examiners need to check the work.

7.2 Writing findings

In examples, show report fields and remediation outcomes. Never include working attack procedures. When quoting synthetic evidence, use hashes and ticket IDs. Severity language should match your scoring sheet, not marketing adjectives.

For Noah, a finding example in the dissertation shows the ticket ID, the asset class, the severity from his scoring sheet, the ATT&CK technique ID where the tagged arm applies, the recommendation and the remediation outcome within 30 days. It never shows the request that triggered the issue or any credential. Quoting a hash of the synthetic evidence lets an examiner confirm the example matches the archive without the dissertation itself carrying anything an attacker could reuse.

"""Score synthetic findings for report priority (no exploit details)."""
# impact 0-3, exploitability 0-3, exposure 0-3  -> priority
findings = [
    ("SYN-001", "default admin password on staging web UI", 3, 3, 2),
    ("SYN-002", "missing security headers on public site", 1, 1, 3),
    ("SYN-003", "outdated TLS on internal admin port", 2, 2, 1),
    ("SYN-004", "verbose error messages disclose paths", 1, 2, 2),
    ("SYN-005", "service account with domain admin in lab AD", 3, 2, 1),
]

def priority(impact, exploitability, exposure):
    score = impact*4 + exploitability*2 + exposure
    if score >= 16: return "critical", score
    if score >= 11: return "high", score
    if score >= 7: return "medium", score
    return "low", score

for fid, title, i, e, x in findings:
    p, s = priority(i, e, x)
    print(f"{fid} priority={p:8} score={s:2} impact={i} exploitability={e} exposure={x} :: {title}")

Expected output:

SYN-001 priority=critical score=20 impact=3 exploitability=3 exposure=2 :: default admin password on staging web UI
SYN-002 priority=medium   score= 9 impact=1 exploitability=1 exposure=3 :: missing security headers on public site
SYN-003 priority=high     score=13 impact=2 exploitability=2 exposure=1 :: outdated TLS on internal admin port
SYN-004 priority=medium   score=10 impact=1 exploitability=2 exposure=2 :: verbose error messages disclose paths
SYN-005 priority=critical score=17 impact=3 exploitability=2 exposure=1 :: service account with domain admin in lab AD

7.3 Limitations that protect readers

State: synthetic segments; one organisation; volunteer remediators; imperfect ATT&CK tags; 30 days may miss slow fixes; no claim about breach rates. Limitations are part of the contribution because they stop unsafe generalisation into live enterprise programmes such as CBEST or TIBER-EU without further study.

Noah places these limitations before the discussion, so readers meet them before any recommendation. Each limitation narrows a claim. Synthetic segments mean the result may differ on live systems; one organisation means CBM's ticket culture may not be typical; volunteer remediators may be more engaged than average; and imperfect tags mean the effect could be stronger or weaker with perfect tagging. The 30-day window may miss slow fixes that eventually close.

7.4 Reproducibility appendix

Include scripts, templates, ATT&CK version pin, synthetic export and an analysis notebook that rebuilds the primary table. Hash the release so examiners can detect accidental edits.

For CBM, the notebook should rebuild the primary result from the synthetic export: 110 tagged and 108 narrative findings, 62% against 44% remediated in 30 days, with the VLAN 40 rebuild week excluded and also shown kept in. An examiner who can regenerate that table on a clean machine does not need to trust Noah's summary, and any hash mismatch tells them a file changed after release.

"""Verify integrity of a synthetic evidence package."""
import hashlib, json
files = {
    "roe.pdf": b"SYNTHETIC-ROE-v1",
    "scope.csv": b"host,port\n10.20.1.10,443\n",
    "findings.json": b'[{"id":"SYN-001"}]',
}
expected = {n: hashlib.sha256(b).hexdigest()[:16] for n,b in files.items()}
# Simulate tampering of findings.json
current = dict(expected)
current["findings.json"] = hashlib.sha256(b'[{"id":"SYN-001"},{"id":"TAMPERED"}]').hexdigest()[:16]
print(json.dumps(expected, indent=1))
for n in sorted(expected):
    status = "OK" if expected[n] == current[n] else "MISMATCH"
    print(f"{n:16} {status}")

Expected output:

{
 "roe.pdf": "18d74983d403e7db",
 "scope.csv": "01cc4815eddf3de6",
 "findings.json": "7f5f178ab43ef00f"
}
findings.json    MISMATCH
roe.pdf          OK
scope.csv        OK

7.5 Practitioner brief

Two pages: how to add ATT&CK fields to tickets; how to audit tags; which metric to watch (30-day completion by severity); what not to claim (breach reduction, matrix coverage as safety). Ask one CBM engineer to follow the brief cold and note where they stall.

The brief is written for CBM engineers, not examiners. It shows a tagged ticket next to a narrative one, so readers see the difference at once, and lists the refused claims in plain words.

7.6 Worked example (synthetic CBM case)

Noah's limitations page leads with synthetic scope. His appendix regenerates Table 1 from tickets_synth.csv. The findings lab style — priority without an exploit path — matches his templates. Hash verification catches a mistaken edit to the appendix sample before submission.

The mistaken edit matters because the appendix exists so examiners can rebuild Table 1: an undetected change could have left their rebuilt numbers out of line with the 62% and 44% in the results chapter, and the mismatch would have cast doubt on the whole analysis rather than on one file.

7.7 Errors and limits

Methods chapters that omit ethics.
Results without limitations.
Appendices that do not run.

Each error weakens the dissertation. Without ethics in the methods chapter, examiners cannot judge whether the data was collected properly. Results without limitations invite readers to apply them in settings the study never covered. Appendices that do not run cannot support the reproducibility claim, which is why Noah hashes and tests his release. Check the final draft for all three. Ask a reviewer to check them too.

Exercises

EX039 — Outline. List ten dissertation sections. Rubric: 3 = ten coherent; 2 = eight; 1 = five; 0 = none.
EX040 — Finding style. Write SYN-003 in dissertation example style. Rubric: 3 = fields, no exploit steps; 2 = partial; 1 = steps included; 0 = none.
EX041 — Limits. List six limitations. Rubric: 3 = six apt; 2 = four; 1 = two; 0 = none.
EX042 — Hash lab. What does MISMATCH require before submission? Rubric: 3 = investigate, restore, re-hash; 2 = two; 1 = ignore; 0 = none.
EX043 — Brief. Outline the practitioner brief headings. Rubric: 3 = fields, audit, metric, non-claims; 2 = three; 1 = one; 0 = none.
EX044 — Generalisation. Why not claim CBEST applicability yet? Rubric: 3 = different context/oversight/intel-led; 2 = two; 1 = vague; 0 = none.

Synthesis

Writing makes the cycle inspectable: structured claims, bounded limits, runnable appendices and a brief practitioners can actually use.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →