◇ OpenCyber Academy
Doctoral research · Chapter 2 · English

Chapter 2 — Information security: research frontier

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Information security: research frontier

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Foundations"]
  N2["2.2 Management standards"]
  N3["Lab — High-water-mark security categorisation of fiv"]
  N4["2.3 Reproducing a categorisation"]
  N5["2.4 The gap"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Foundations"]
  N2["2.2 Management standards"]
  N3["Lab — High-water-mark security categorisation of fiv"]
  N4["2.3 Reproducing a categorisation"]
  N5["2.4 The gap"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Foundations]
    |
    v
[2.2 Management standards]
    |
    v
[Lab — High-water-mark security categorisation of fiv]
    |
    v
[2.3 Reproducing a categorisation]
    |
    v
[2.4 The gap]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) map foundational and current sources on information security management; (2) reproduce a security categorisation from a published standard; (3) locate an open research gap.

2.1 Foundations

Yusuf starts with foundations. Saltzer and Schroeder's 1975 paper set out design principles such as least privilege, fail-safe defaults and complete mediation, which still frame access control research. NIST SP 800-12r1 introduces confidentiality, integrity and availability as the core security objectives and explains how organisations manage them. Anderson's Security Engineering, third edition, shows through many cases that failures usually arise from incentives, usability and organisational process rather than broken cryptography, which supports Yusuf's focus on how controls are prioritised. He summarises each source in a short annotated note.

2.2 Management standards

He reviews management standards. ISO/IEC 27001:2022 sets requirements for an information security management system, including risk assessment and treatment. ISO/IEC 27002:2022 gives guidance on controls. ISO/IEC 27000:2026 provides an overview of how the family fits together. NIST SP 800-53r5 offers a large control catalogue, and the NIST Cybersecurity Framework 2.0 organises outcomes into govern, identify, protect, detect, respond and recover functions. He notes that all of these assume risk-based selection, yet say little about measuring its effect. Yusuf records this observation as the starting point for his gap.

Lab — High-water-mark security categorisation of five synthetic systems

"""FIPS 199-style high-water-mark categorisation of synthetic systems (stdlib only)."""
L = {"low": 1, "moderate": 2, "high": 3}
systems = {
    "payroll":        ("moderate", "high", "moderate"),
    "public_website": ("low", "moderate", "moderate"),
    "water_scada":    ("low", "high", "high"),
    "permits_portal": ("moderate", "moderate", "low"),
    "case_records":   ("high", "moderate", "moderate"),
}
from collections import Counter
cat = {s: max(v, key=L.get) for s, v in systems.items()}
for s, v in systems.items():
    print(f"{s:<15} C={v[0]:<8} I={v[1]:<8} A={v[2]:<8} -> {cat[s]}")
print("overall:", dict(Counter(cat.values())))

Run with python3 lab_category.py. Verified output:

payroll         C=moderate I=high     A=moderate -> high
public_website  C=low      I=moderate A=moderate -> moderate
water_scada     C=low      I=high     A=high     -> high
permits_portal  C=moderate I=moderate A=low      -> moderate
case_records    C=high     I=moderate A=moderate -> high
overall: {'high': 3, 'moderate': 2}

2.3 Reproducing a categorisation

To understand risk-based selection concretely, Yusuf reproduces the categorisation approach of FIPS 199, which rates the potential impact of losing confidentiality, integrity and availability as low, moderate or high and takes the highest rating as the system's category. In the lab, five synthetic Fernvale systems yield three high systems, payroll, water control and case records, and two moderate systems, the public website and the permits portal. Water control is high despite low confidentiality impact, because integrity and availability failures could harm the public.

2.4 The gap

Yusuf searches for studies measuring whether risk-ranked control selection changes security outcomes in organisations. He finds many descriptions of frameworks, surveys of adoption and case reports, but few designs comparing adopters with non-adopters over time using operational measures such as patch latency. He frames this as his gap. Prof. Hald asks him to state the gap narrowly, as evidence about two outcome measures in one public body, rather than claiming to test the whole of risk-based security management. Yusuf rewrites the gap accordingly.

Worked example

Yusuf reviews Saltzer and Schroeder, SP 800-12r1, Anderson and the ISO/IEC 27000 family, SP 800-53r5 and CSF 2.0, reproduces FIPS 199 categorisation giving three high and two moderate systems and states a narrow gap.

Synthetic case. Systems are synthetic; outputs come from lab_category.py; all cited works are real.

Errors and limits

Claiming a thesis tests a whole framework overstates what one study can show.

Exercises

Continue studying — lesson 02 (chapter 02 of 08)

← Chapter 01 · Course chapter index · Chapter 03 →

Continue to the next authored lesson.