◇ OpenCyber Academy
Master's · Chapter 8 · English

Chapter 8 — Independent review and defense

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Independent review and defense

Lesson map

Lesson 08 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["8.1 Claim audit"]
  N2["8.2 Examiner families"]
  N3["8.3 Disclosure"]
  N4["8.4 Operator brief"]
  N5["8.6 After the defense"]
  N6["Chapter synthesis"]
  N7["Chapter 1"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["8.1 Claim audit"]
  N2["8.2 Examiner families"]
  N3["8.3 Disclosure"]
  N4["8.4 Operator brief"]
  N5["8.6 After the defense"]
  N6["Chapter synthesis"]
  N7["Chapter 1"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes and connection]
    |
    v
[8.1 Claim audit]
    |
    v
[8.2 Examiner families]
    |
    v
[8.3 Disclosure]
    |
    v
[8.4 Operator brief]
    |
    v
[8.6 After the defense]
    |
    v
[Chapter synthesis]
    |
    v
[Chapter 1]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes and connection

After this chapter you can (1) audit claims before submission, (2) prepare for examiner questions, (3) handle disclosure for implementation flaws, and (4) translate findings for operators with confidence levels.

8.1 Claim audit

Every claim needs evidence, scope and a falsifier. Delete "secures water utilities"; keep "detected single-sensor replay in two synthetic contexts". Run the audit on the abstract, the contributions bullet list and the conclusion — those are where overclaims hide. Ask a peer to mark every verb that implies field effectiveness ("protects", "prevents", "secures", "hardens") and justify or remove each one. A keyword script helps as a first pass; the human audit still reads every claim in context.

Record each claim's outcome in the claim register with the date of the audit. A claim that survives needs a pointer to a table or figure; a claim that is narrowed needs its new wording; a claim that is cut needs a note of why. The audit is finished when every sentence in the abstract has a row.

8.2 Examiner families

Positioning (what is new?), validity (why generalize?), adversary (stronger attacker?), safety (how bounded?), ethics (what withheld?), impact (Monday morning change?). Answer to impact: require an independently wired second measurement of key variables and display predicted versus reported values.

Prepare a one-page cheat sheet with a two-sentence answer to each family and a pointer to a figure or table. In the defense, answer the question asked, then stop — do not volunteer the entire chapter. If you do not know, say what evidence would answer it and what you actually have. Practice aloud once with a peer who interrupts.

8.3 Disclosure

Design properties of public specs (Modbus has no authentication) are not vulnerabilities. Implementation flaws in a product go through vendor and, where appropriate, CISA CVD before detail is published.

For Harbor Loop that means describing replay as a consequence of Modbus lacking authentication, without treating it as a new flaw. If work on Rig R2 revealed a defect in a specific PLC's firmware, the product and the details would be withheld from the dissertation until the vendor had been told, with the timeline agreed and recorded.

8.4 Operator brief

High confidence: band alarms alone miss replayed level readings (model + design). Medium: independent flow measurement plus residual detects single-sensor replay (two synthetic contexts). None: protection if one device controls both measurements — measured failure.

Keep the brief to one page, with each statement tagged by its confidence and its evidence. Operators will act on the none line: if one device reads both the level and the flow meter, residual detection cannot be relied on. The brief should say what to check on Monday, such as whether the two measurements are wired independently.

8.5 Common errors and limits

Overreach in the defense talk; publishing exploit detail before disclosure; confidence labels without evidence.

In the defense, keep to the scope the dissertation measured, and answer stronger-attacker questions with class B rather than speculation. Hold implementation details until disclosure is complete. Every confidence label in the operator brief needs the evidence behind it named; a label without evidence is an opinion presented as a finding. Before the defense, rehearse each examiner family once with the cheat sheet, and mark any answer that reaches beyond the measured contexts, so it can be narrowed before the real questions arrive.

8.6 After the defense

Archive the final PDF, the claim register, the code tag and the ethics paperwork. If a paper will be submitted, freeze the dissertation text that the paper may not contradict. Schedule disclosure timelines before conference deadlines, not after. Thank the operators and lab managers who made Rig R2 possible — and do not surprise them with a press release that names the campus lab as a vulnerable plant.

Keep the archive manifest and hashes alongside the final text so a later reader can show which code produced the published numbers. If corrections arrive after the defense, add them as dated errata rather than editing the archived copy.

Exercises — chapter 8

Chapter synthesis

Audit, prepare, disclose carefully, translate with confidence labels. The master's contribution is a measured comparison and its measured limits.

Continue studying — chapter 08 of 08

← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Doctoral OT course →