By the tiswa editorial team, from the official sources listed at the end of this guide. How we write our guides
A final-year student shows the committee a screen of scanning tools running. The committee asks: what scope were you allowed? Where is the permission? What did you fix? He has no answer. The tools were fine. What was missing was the frame that makes the work a cybersecurity project rather than an experiment.
How do you choose a cybersecurity graduation project?
Pick an idea you can carry out completely on your own machine or in your department’s lab, with a start and an end you can measure. Broad offensive ideas such as “hack a network” usually need permission you do not have. Defensive and assessment ideas are safer and stronger: assessing the security of a web app you build yourself, building a log collection and alerting setup in a virtual environment, or comparing hardening settings for one service before and after. A wider list by major is in graduation project ideas.
Before settling on the idea, ask your supervisor about the department’s policy on testing: where are penetration tests allowed, does the department provide an isolated environment, and does the committee want a copy of the permission? The answers set what you can do, and they differ between universities.
What is a worked example of a cybersecurity graduation project?
Here is an illustrative example of a hypothetical project titled “Assessing the security of an appointment-booking web app before and after hardening.” It shows the method; it is not a set of published results:
- Build the target yourself
Install a simple web app (an appointment booking form) in a virtual machine isolated from the network. You own it and control all of it.
- Write the scope
A one-page document: what will be tested (the app and server), what will not (anything outside the machine), the tools, the period and your supervisor’s approval.
- Choose the reference
Use the OWASP Top 10 for categories of application risk,1 and the OWASP Web Security Testing Guide for test steps.2
- Run the tests
Check login, permissions, input fields, error messages and sessions, and log every step with the time and what you observed.
- Classify the weaknesses
For each: what it is, where, how to reproduce it, which category it falls under, the impact, and a severity rating using a scale you explain in the report.
- Fix and re-test
Change the code or settings, repeat the same tests and put before and after results in a table.
This order follows the spirit of NIST’s guide to security testing and assessment, which sets out planning, execution, analysis of findings and reporting.3 You need not follow it to the letter, but cite it in the report to show your method rests on a reference.
How do you write the report for a cybersecurity project?
| Section | What it contains | Question it answers |
|---|---|---|
| Summary | The problem and the outcome in one paragraph | What did you do and what did you find? |
| Scope and method | Test boundaries, tools and reference | What did you test, and how? |
| Findings | A table of weaknesses, categories and impact | What did you find? |
| Remediation | The fix and the re-test | Did the problem go away? |
| Limits | What the testing did not cover | Where does your proof stop? |
| References | Cited sources | What did you rely on? |
The limits section earns respect from the committee. Say honestly what you did not test. For wording, see the limitations section, and for the summary, the graduation project abstract.
What are the legal and ethical limits of a cybersecurity project?
The general rule: test what you own or what its owner has authorised in writing, and nothing else. The National Cybersecurity Authority is the national body for the field in the Kingdom,4 and for official frameworks and controls you should go to its site and to your supervisor, not to what classmates say. Keep real people’s or organisations’ data out of your report, and never publish a weakness that affects a real system.
If you put the project on a platform such as GitHub, publish only the code you wrote and the report, not ready-made attack tools aimed at real systems. Working with repositories is covered in the GitHub guide for beginners.
Should you use AI in a cybersecurity project?
It can explain a term or review the wording of your report, but do not rely on it to judge a weakness, and do not send it code or logs that belong to a real organisation. Safe use is covered in AI for cybersecurity students. If you are planning the road after graduation, read the cybersecurity roadmap.
What should you check before the defence?
- The scope is written
The scope document is approved by your supervisor and states what was not tested.
- The lab is isolated
The virtual lab is not connected to real systems or to a residence network.
- Every weakness can be reproduced
Each has steps to reach it again and a screenshot or log.
- Every weakness has a fix
The change is written down and the test after it is recorded.
- Sources are named
OWASP, NIST and anything else you used are in the references.
- The talk is ready
Slides that open with the problem and end with the result; see defence slides.
