◇ OpenCyber Academy
Master's · Chapter 7 · English

Chapter 7 — Dissertation writing and limitations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Dissertation writing and limitations

Lesson map

Lesson 07 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Structure follows questions"]
  N2["7.2 Strong limitations"]
  N3["7.3 Two audiences"]
  N4["7.4 Restricted data in writing"]
  N5["7.5 Judgment language"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Structure follows questions"]
  N2["7.2 Strong limitations"]
  N3["7.3 Two audiences"]
  N4["7.4 Restricted data in writing"]
  N5["7.5 Judgment language"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX043"]

[Learning outcomes]
    |
    v
[7.1 Structure follows questions]
    |
    v
[7.2 Strong limitations]
    |
    v
[7.3 Two audiences]
    |
    v
[7.4 Restricted data in writing]
    |
    v
[7.5 Judgment language]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) structure a dissertation around research questions; (2) write a limitations section that strengthens rather than apologises; (3) present results to two audiences — examiners and practitioners; (4) handle restricted data in the written product.

7.1 Structure follows questions

Introduction states the question and why ports care. Literature shows what is known and the gap. Methods describe design, data dictionary, ethics and validation. Results answer each aim in order. Discussion interprets, compares with literature, and states implications. Conclusion is short. Each results subsection should open with the aim it answers.

Lucía's results chapter has three subsections, one per aim: median time-to-block for members, comparison with matched non-members, and the share of indicators blocked, monitored or ignored. Her discussion then takes up the automation judgment, labelled as such.

7.2 Strong limitations

A strong limitation names the problem, its likely direction of bias, and what was done about it. "Small sample" alone is weak. "With seven members and six non-members, the median difference is imprecise; the bootstrap interval is wide and crosses small effects, so practical significance is uncertain" is strong.

Lucía's day-level stratum gets the same treatment: members with ticket dates only have timings rounded to whole days, which probably overstates their time-to-block; analysing them separately prevents that error from widening the gap between members and non-members.

7.3 Two audiences

Examiners want method and argument. CPSG members want a one-page brief: what the median gap was, what it suggests for staffing and automation, and what it does not show. The brief carries the same caveats in plainer language.

Lucía's brief to the CPSG board says the member median was 3.0 hours against 10.0 for matched non-members, that two members with automated TAXII-to-firewall pipelines accounted for the fastest blocks, and that small samples and self-reported automation limit both points. It does not tell members to buy automation; it suggests what to measure next.

7.4 Restricted data in writing

The dissertation is likely to be public through the university library, so it is written as TLP:CLEAR. No member names, no indicator values from the AMBER collection, no quotations from member bulletins. Synthetic examples illustrate formats.

The leak review caught the one place this failed: a figure caption named a port's city, which would identify the member. Lucía replaced it with "Member C", logged the change and notified the board. Synthetic STIX examples illustrate the format in the methods chapter without carrying any real indicator values.

7.5 Judgment language

When interpreting, separate observation ("members blocked faster in this sample") from judgment ("automation of TAXII ingestion likely explains part of the gap"), as ICD 203 recommends for analytic products. Label the judgment's confidence and basis.

Lucía's discussion labels her automation explanation as a judgment with moderate confidence, because automation status was self-reported by members, and proposes a follow-up study that measures it directly from pipeline logs. The observation sentence carries the 3.0- and 10.0-hour medians and their interval; the judgment sentence carries its confidence and the self-reported basis. A reader who rejects the judgment still has the observation intact.

Worked example

Lucía's discussion argues that two members with automated TAXII-to-firewall pipelines account for the fastest blocks. She labels this a judgment with moderate confidence, notes that automation status was self-reported, and suggests a follow-up study that measures it directly.

Synthetic case. Automation details and members are invented.

Errors and limits

Hiding limitations to look stronger invites examiner attack. Practitioner briefs that drop caveats can cause poor investment decisions.

Exercises

Synthesis

Let questions shape the text, write limitations with direction and mitigation, brief practitioners honestly, and write as if TLP:CLEAR.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →