◇ OpenCyber Academy
Master's · Chapter 7 · English

Chapter 7 — Dissertation writing and limitations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Dissertation writing and limitations

Lesson map

Lesson 07 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Structure"]
  N2["7.2 Limitations"]
  N3["7.3 Two audiences"]
  N4["7.4 Linking to frameworks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Structure"]
  N2["7.2 Limitations"]
  N3["7.3 Two audiences"]
  N4["7.4 Linking to frameworks"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX039"]

[Learning outcomes]
    |
    v
[7.1 Structure]
    |
    v
[7.2 Limitations]
    |
    v
[7.3 Two audiences]
    |
    v
[7.4 Linking to frameworks]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) structure a master's dissertation; (2) write a candid limitations section; (3) report results for both academic and practitioner readers.

7.1 Structure

Lucas structures his dissertation in seven parts: introduction, literature and standards, method, results, rival explanations, discussion and conclusion, followed by appendices with the analysis plan, codebook and scripts. Each results claim cites a table or figure, and each table states its sample size. He keeps the main text near 20,000 words, as Marlow requires, moving long material to appendices. He writes the method so precisely that another student at another company could repeat the study with their own access data. He follows the template.

7.2 Limitations

His limitations section is direct. The design is observational, so frequency may not be the cause. Diligence remains a partial alternative explanation. The study covers one company in one year. Excess access depends on the role catalogue, which was revised during the pilot. The bootstrap interval is wide. The cost estimate relies on self-logged hours, which may be inaccurate. For each limit he states how it could bias results and in which direction, rather than listing limits without consequences, so readers can weigh them.

7.3 Two audiences

Lucas writes a four-page practitioner summary for Tessaly alongside the dissertation. It avoids statistical jargon, explains that quarterly units had about half the excess access with a wide margin of uncertainty, and presents the risk-based option with its cost. He is careful not to overstate. He also shows the summary to two unit managers, who point out that a phrase implied their units were careless. He rewrites it, because reports that blame groups can reduce cooperation in future reviews. Both managers approve it.

7.4 Linking to frameworks

In the discussion, Lucas relates his findings to frameworks. ISO/IEC 27001:2022 requires monitoring and evaluation of the management system, and his method offers one way to evaluate an access control rather than only confirming that reviews took place. NIST CSF 2.0 Govern outcomes include oversight of risk management strategy, and he suggests boards ask for outcome measures like excess-access rates. He frames these as suggestions grounded in one study, not as requirements of the standards, which he paraphrases rather than quotes at length.

Worked example

Lucas writes a seven-part dissertation, states each limit with its likely bias and produces a non-blaming practitioner summary.

Synthetic case. The dissertation is synthetic; the standards are real.

Errors and limits

Practitioner summaries can oversimplify. Framework links are interpretations.

Exercises

Synthesis

Good dissertations make claims traceable, limits consequential and summaries fair.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →