◇ OpenCyber Academy
Bachelor's · Chapter 18 · English

Chapter 18 — Research methods I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Research methods I

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Framing a question"]
  N2["18.2 Choosing a method"]
  N3["18.3 Ethics and data"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Framing a question"]
  N2["18.2 Choosing a method"]
  N3["18.3 Ethics and data"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX052"]
[Learning outcomes]
    |
    v
[18.1 Framing a question]
    |
    v
[18.2 Choosing a method]
    |
    v
[18.3 Ethics and data]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) frame a researchable question about Fernway's security; (2) choose between survey, case study and experiment; (3) plan ethical data collection.

18.1 Framing a question

Dr Bellini asks Lucas to turn his placement into a research project. Lucas starts with a vague interest in whether staff follow security policy and narrows it to a question he can answer: do Fernway store staff who received short in-store briefings report suspicious emails more often than staff who received only the online module? The question names a population, an intervention, a comparison and an outcome. It is answerable with data Fernway already collects through its report-phishing button, and it matters to Hannah because it informs how training budget is spent.

18.2 Choosing a method

Lucas considers three methods. A survey would ask staff what they do, but self-reports overstate good behaviour. A case study would describe one store in depth but would not support comparison. A quasi-experiment comparing stores that received briefings with similar stores that did not, using actual report rates, gives the strongest answer available. Wohlin and colleagues (2012) describe how to design such studies in software and systems settings, including threats to validity. Lucas chooses the quasi-experiment and notes that stores were not randomly assigned, which limits causal claims.

18.3 Ethics and data

Lucas applies to Ashgrove's ethics committee. He will use only aggregated report counts per store per month, with no individual names, and Fernway's management agrees in writing. Staff are told through a notice that store-level data is used for a student study. He stores data on university systems, deletes it after the project and will share only aggregate results. The committee approves with a condition that stores with fewer than five staff are merged so that no individual's behaviour can be inferred from a store figure.

Worked example

Lucas narrows a vague interest to a comparative question, chooses a quasi-experiment over survey and case study, and obtains ethics approval with a small-cell merging condition.

Synthetic case. The study and stores are synthetic; Wohlin et al. (2012) is real.

Errors and limits

Non-random assignment limits causal claims. Report button use is only one indicator of vigilance.

Exercises

Synthesis

Good student research starts with a precise question, the strongest feasible method and data collected ethically.

Continue studying — chapter 18 of 40

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →