Supervising B.Sc./M.Sc. theses

What to expect from supervising students

So far, I supervised approximately 30 B.Sc./M.Sc. students. My supervision style might not work for everyone—but it turned out to work quite well for the average chaotic nerd with an interest in IT security.

When deciding to supervise a thesis, many people think this could be a great workforce in accelerating their PhD. I didn't have that illusion, as my M.Sc. thesis co-supervisor told me that he had a ratio of 1/3 of the students actually helping him with research, and the others just being more supervision overhead than what they got in return. Depending on your research topic this ratio is quite accurate. In fact, not supervising theses, working on your own whenever possible, and carefully selecting with whom you're going to collaborate might be the better career advice for finishing your PhD within a short time.

Nonetheless, being a good thesis supervisor can be very rewarding and you will learn a lot. While most think a PhD is about publishing papers and joining industry in some management position, a PhD also is about obtaining soft skills. Even when you fail (and you will fail!) when supervising students, there is a lot to learn. Once you get better in supervising students, the students will profit from your supervision. Their thesis is an important part of their career and they are about to join industry or start a PhD as well. When supervising a thesis, your job is being a good mentor, which includes answering all their questions, helping them with their career, and even mental support—writing a thesis can be exhausting and it might not always be the top priority in a student's life.

My first M.Sc. student

When supervising the first student, I horribly failed. The student finished the thesis but I was definitely not providing good supervision. In retrospective, I made the following mistakes and probably even more than the ones listed here:

• The topic I chose did not match the student's background. He was interested in forensics while I was working with wireless signals. As there is no good forensics group at our university he accepted the topic. Nowadays I would adjust the topic or not supervise the student. And, wow, forensics, I could definitely need that knowledge!
• I underestimated the topic's complexity. Students often underestimate this but as a supervisor you are responsible for planning a topic that is feasible to finish within time. If you are not sure how much work something is, the thesis goals should be flexible. "When the thing I imagined finally works!" is not a good definition of such a goal. The worst part was that it got too close to low-level signal processing, which neither me nor the student expected that topic to be, and then a colleague of mine joined for thesis co-supervision.
• I underestimated how hard writing a thesis is. Especially for someone who is not good at writing. My colleague ended up in reading a lot of his texts.

Instead of supporting him I just told everything would be fine in the end. He handed in a thesis and it was good. However, it took way too much time for everyone: him, me, my colleague.

I think a lot of thesis supervision just goes like this. The supervisor has an idea that marginally fits to the student's background, only asks if the student already finished building that one big thing yet, and only reads the final version of a thesis. Then, the thesis gets a bad grade despite working a lot because the supervisor did not get what they expected. While this kind of supervision style minimizes efforts and just getting a 1/3 ratio or even worse does not matter that much any more, it is just a waste of time.

Setting goals

A lot of students want to write a thesis within our group. This has not always been the case. There are a few things we offer:

• A grading sheet, which the students get in advance. They know how their thesis, results, final presentation and working attitude will be graded. They know that even if "the thing their supervisor imagined" did not work out because it was infeasible they can still get a good grade. In fact, I had two students with everything going wrong and still getting a 1.3 (best possible grade in Germany is 1.0). The grading sheet helps the students on setting a focus when everything fails but they want to finish, makes results comparable, etc.
• A free-style application form, where students can enter their skills without selecting a topic. Our website is not up-to-date anyway. We try to find a good match for the skills of each students. Considering that a student spends six months on a topic it should be a good match. These days, we are so overwhelmed by applications that some of them are not answered, sorry for that ;)
• A supervision agreement. This document describes supervision in both directions, i.e., what a supervisor can expect from their student and what a student can expect from their supervisor. It is somewhat specific to our group, as Max was basically asking everyone in the team what they think might be important and summarized this into this document. While it might sound very formal it helps a lot. Especially B.Sc. students who never worked for a company before have no idea what to expect at all. Most things in that document might sound quite obvious for everyone who has already supervised theses.
• Mid-term talks for M.Sc. theses. These are not graded. They are intended to provide students with early feedback not just by the PhD student supervising them but also by other students and my boss.
• Example theses. Some of our students won prizes for their thesis. While this is not the bar for a 1.0, having a few good examples helps a lot.

Except from the supervision agreement, which might differ a lot for each group, these things are relatively easy to offer.

Selecting a topic

Going back to my failures when supervising my first student, the free-style application form helps in selecting better topics. It still means that you need to adapt your research scope and not everyone has that choice. I got very decent theses out of supervising topics that were "out of scope" of my PhD and I eventually changed my scope. If your goal is not finishing your PhD within short time, go for supervising interesting topics!

One disclaimer, though, be honest to the student if something is not your main expertise. Letting a student select a topic also means that you might not be able to answer all their technical questions. The less you know the more you will learn from them, though :D

Especially when it comes to the topic of IT security, six months of research can be short and the student might "fail". Failing means that they analyze a system or protocol and cannot find any flaw in it. Clearly communicate that failing to find a vulnerability is not the same as failing a thesis. In general, grading a thesis should go beyond "works" or "doesn't work". Make thesis goals flexible. In my area, reverse-engineering and documenting something proprietary is already a success that can fill a decent amount of thesis pages. Doing this in a structured manner and discussion why the researched thing is (in)secure can be sufficient for a thesis. Clearly communicate this. Nothing is worse than writing a thesis with the thought in your mind that you failed anyway.

Be there for your students

Meet them weekly, even if that meeting is just 15 minutes. During my own M.Sc. thesis I procastinated a bit and typically was the most productive 1-2 days before a meeting. And do not underestimate talking a lot to them in the very beginning of their thesis. While the initial meetings might be the most boring ones as a supervisor, as they are all the same, they are about getting your students started. Things that might appear trivial, such as talking about related work and slightly re-adjusting the research topic, are very valuable to students.

Request anything they wrote as early as possible, even if it is just a part of the introduction or the implementation. Meanwhile, I worked with a lot of students who had problems writing longer texts, even when writing in German. Dyslexia is more common than you think and these students are great nonetheless. Just figure this out early. Send them detailed feedback in time, be pedantic about the first text that you get. Tell them if they should get an external proofreader early on. And, something specific to our group: my boss still reads and grades all theses. Meanwhile, I learnt a couple of things that he really hates when reading a thesis and I try to optimize my feedback for this ;)

Ooooh, and, 95% of the students hand in their thesis on the last day. Be ready for that and communicate when you will do your last round of proofreading. I'm not saying be there for your students 24/7, but my students definitely appreciated getting feedback on the final version of their thesis 1-2 days before the hand-in.

Also, help the student in handling all the things that could happen during a thesis. Their thesis might not be their top priority. Know the examination rules. For example, at our university students can withdraw a thesis within 2 months if this is their first thesis attempt, and it won't count as failed thesis attempt in this case. If you feel that such rules might be relevant to the student, tell them. Always keep these deadlines in mind. And know how to extend a thesis in case something doesn't work out. Support them with all the regulations that might get in their way as soon as other things in their life become a higher priority than finishing their thesis.

I got a couple of "problematic" students and most of them did very well in the end. You might not profit from supervising these students but they will definitely profit from your support. Pick a non-perfect student from time to time if you consider expanding your soft skills not being a waste of time.

Career support

Some students already know what they want to do after their thesis. Surprisingly, many are still undecided what they want to do, even though finishing their M.Sc. is just six months in the future and they should apply for jobs soon. This problem might be specific to Germany/Europe, though, where studying is almost for free, and joining industry to pay off your student debts is not required. Ask them what they want to do after their thesis and help them in finding a good job. Tell them what typical salaries are, especially if this is their first job. We don't talk a lot about salaries in Germany...

You might not have good industry contacts when starting your PhD but your B.Sc./M.Sc. students will join industry before you have the chance to do so. Take that chance and ask them where they go and later ask them how they liked it so far. Your first generation of students might pave the way for your second generation of students. I already had the situation where a student wanted to join a company as trainee, told me about this, and I had the contacts to make it possible for her to directly join a security team without being a trainee. It can be as simple as this and still means a lot to your students.

I know that many supervisors consider this out of scope but what else is supervising a thesis about if not thinking about the next steps in life? And an academic career is not the answer to everyone.

Co-supervision and industry collaboration

We often team up in supervising students. I had and still have too many students. However, co-supervising a student is less work and you might still be supportive. Especially when the primary supervisor is supervising a thesis for the first time. The other way round, if you are supervising a thesis for the first time, ask a colleague if they can be a co-supervisor. And be clear about who has which priority, I definitely failed at that once.

Due to the sheer amount of students I recently started teaming up two students together for one topic. They get different tasks but would work within the same area. This definitely saves some time for me and as of now I would say it also helps the students.

Many students want to do their thesis as an industry collaboration. Their typical motivation is not getting two supervisors but getting a salary for writing a thesis. This is the worst motivation one can have. There are other means of financial support while writing a thesis. Many contracts with companies have NDAs or strict regulations on patents. We once allowed signing a student such a contract because we didn't know this in advance and the student would've been in trouble with their time schedule in studying abroad the next semester. But we never published anything of this thesis. In the worst case, this is not just about publishing. Industry typically sees results as "works" and "doesn't work", they only care about the implementation but not about the thesis itself. I did my B.Sc. at DHBW, where all Bachelor theses are industry collaborations, and this problem is more common than you might think.

When it comes to external collaborations I like to ask questions about NDAs, patents, and what the specific advantages for a student would be. If it is knowledge and support in a way that I cannot provide, all right, but otherwise... 🤷🏻‍♀️

Publications, thesis awards, travel grants, 🦄

Keep in mind that some students just want to write a thesis. This is fine. Publishing a paper, talking on stage, traveling abroad—this is not for everyone. Ask them if they are okay with you writing a paper about their thesis in that case.

Anyway, tell your students about these opportunities and support them. As a publication resulting from their thesis is their first paper you might be the one writing it. Also, handing in a thesis for an award means that you need to write some form of recommendation letter. At my university, we also have a lot of gender equality money that enables female* students to travel almost anywhere. Finding security bugs can also mean that students could get bug bounties. Supporting your students in these opportunities is still little effort compared to what it means to them.

My students were talking on stage, sometimes together with me, got awards for their excellent theses, publishing papers at top venues, got some bug bounties, and traveled to places like Singapore, Las Vegas, Oulu and Leipzig (yes, 36C3, not that exotic but paid by university).

If you find that great 🦄 student do whatever you can to support them. Yet, do not forget to support your weak students as well, they will need your support. You might not start with supervising 🦄 students but your supervision might also not be that great. Once you get better the applications in your inbox will get better. Still give a chance to everyone—or, if your inbox is exploding as mine, give a fair chance to random "weak" students from time to time.