Chapter 42 — Information security: applied research
Lesson map
Lesson 42 published. Map, example, EX124.
flowchart TD
N0["Learning outcomes"]
N1["42.1 Question"]
N2["42.2 Design"]
N3["42.3 Findings"]
N4["42.4 Value of the study"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX124"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["42.1 Question"]
N2["42.2 Design"]
N3["42.3 Findings"]
N4["42.4 Value of the study"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX124"]
[Learning outcomes]
|
v
[42.1 Question]
|
v
[42.2 Design]
|
v
[42.3 Findings]
|
v
[42.4 Value of the study]
|
v
[Worked example] --> [Exercise EX124]
Learning outcomes
You will (1) frame an applied research question from operational data; (2) design a fair comparison; (3) report findings with limits.
42.1 Question
Lindiwe's applied research asks whether depots with badge-tap logins on warehouse terminals have fewer account misuse incidents than depots still waiting for rollout. The question arises from the multi-factor rollout, which reached depots in stages for practical reasons. Prof. Hale points out that staged rollouts create natural comparisons, but that the order of depots was chosen by size, which could bias any difference. She writes the question in one sentence and checks it with the security lead, who confirms the incident register records the necessary details for every depot. Prof. Hale approves the question.
42.2 Design
Lindiwe compares incident rates per hundred staff before and after rollout in depots that adopted early with depots that adopted late, using the period when late depots had not yet started. She checks that incident rates in both groups were similar before rollout. She defines incidents precisely from the incident register: confirmed use of an account by someone other than its owner. She fixes this definition and the comparison before examining outcomes. Prof. Hale reviews the plan and confirms that it was fixed before outcomes were examined.
42.3 Findings
The synthetic data show fewer incidents after rollout in early depots and little change in late depots over the same months. However, incidents are rare, only a handful in each group, so the difference is uncertain. Lindiwe reports counts, rates and the comparison, stating that the direction supports the rollout but the evidence is weak. Prof. Hale praises her for not turning a small count into a confident claim. She presents the counts in a simple table with both periods for both groups, so readers can see the small numbers directly.
42.4 Value of the study
Lindiwe argues that the study's main value is a reusable method: defining incidents consistently, using staged rollouts as comparisons and checking pre-rollout similarity. Saltmarsh can repeat it as more data accumulate. She also notes that shared logins ending is itself an accountability gain, regardless of incident counts. She learns that applied research in security often yields methods and modest evidence rather than definitive answers. The security lead asks her to write the method as a short procedure, so the team can rerun the comparison each year as the incident register grows.
Worked example
Lindiwe compares early and late badge-tap depots using a fixed incident definition, finds a favourable but uncertain direction from small counts and emphasises a reusable method.
Synthetic case. Data are synthetic.
Errors and limits
Small incident counts cannot support confident conclusions.
Exercises
- EX124 — Natural comparison. What created the natural comparison? Rubric: 3 = the staged rollout;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX125 — Incident definition. How is an incident defined? Rubric: 3 = use of an account by someone other than its owner;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX126 — Evidence strength. How strong is the evidence? Rubric: 3 = favourable but weak;; 2 = partly correct;; 1 = strong;; 0 = none.
Continue studying — lesson 42 (chapter 42 of 50)
← Chapter 41 · Course chapter index · Chapter 43 →
Continue to the next authored lesson.