◇ OpenCyber Academy
Engineering · Chapter 42 · English

Chapter 42 — Identity and access management: applied research

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 42 — Identity and access management: applied research

Lesson map

Lesson 42 published. Map, example, EX124.

flowchart TD
  N0["Learning outcomes"]
  N1["42.1 A research question"]
  N2["42.2 Design"]
  N3["42.3 Results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX124"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["42.1 A research question"]
  N2["42.2 Design"]
  N3["42.3 Results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX124"]

[Learning outcomes]
    |
    v
[42.1 A research question]
    |
    v
[42.2 Design]
    |
    v
[42.3 Results]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX124]

Learning outcomes

You will (1) frame a small applied research question from the project; (2) design a fair comparison; (3) report results with limits.

42.1 A research question

Sana's project raises a question worth studying carefully: does showing last-use dates in access reviews increase the share of unneeded access removed? Herley (2009) argued that people reject security effort whose cost exceeds its visible benefit, which suggests that making benefit visible might change reviewer behaviour. She frames the question narrowly, defines removal rate as the share of reviewed items removed and later confirmed as unneeded, and agrees with the council to use the next quarterly review as the setting.

Requiring confirmation that removed items were unneeded guards against a removal rate inflated by deleting access people still use.

42.2 Design

Departments are split into two groups at random: one sees last-use dates in its review, the other sees the review without them. Both use the same descriptions and list lengths. Removal decisions are checked afterwards by application owners, who do not know which group a department was in, to classify each removal as correct or wrong. Wrong removals, which must be reversed, are counted as harm. Ethical approval from the institute covers the study, and managers are told that review design is being evaluated.

42.3 Results

In the synthetic results, departments shown last-use dates remove 11 percent of reviewed items, against 5 percent without them, with a similar rate of wrong removals in both groups. With only twelve departments, the uncertainty is large, so Sana reports the difference with an interval and avoids claiming a precise effect. She also notes that managers in the dates group spent slightly longer per item, which matters for adoption. The finding supports showing last-use dates, but it should be confirmed in further review cycles.

42.4 Limits and use

Sana lists limits: one organisation, one cycle, small numbers, and the possibility that managers discussed the study across groups. Despite these, the result is useful: it supports a low-cost change and gives the council a method to keep testing review improvements. She writes the study as a chapter of her thesis and as a short practitioner note, distinguishing what the evidence shows from what it suggests, so readers do not take a promising early result for settled knowledge. A second cycle is planned to check the result.

Worked example

A randomised comparison across twelve departments finds 11 percent versus 5 percent removal with similar wrong-removal rates; Sana reports it with an interval and clear limits.

Synthetic case. Departments, rates and outcomes are synthetic.

Errors and limits

Reporting a small study's difference without uncertainty presents a promising signal as an established effect.

Exercises

Synthesis

Small, fair applied studies can improve identity practice when results are reported with honest uncertainty and limits.

Continue studying — chapter 42 of 50

← Chapter 41 (draft) · Course chapter index · Chapter 43 (draft) →