◇ OpenCyber Academy
Engineering · Chapter 42 · English

Chapter 42 — Systems, endpoints and hardware security: applied research

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 42 — Systems, endpoints and hardware security: applied research

Lesson map

Lesson 42 published. Map, example, EX124.

flowchart TD
  N0["Learning outcomes"]
  N1["42.1 Question"]
  N2["42.2 Data"]
  N3["42.3 Findings"]
  N4["42.4 Literature"]
  N5["Method details"]
  N6["Ethics"]
  N7["Sharing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX124"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["42.1 Question"]
  N2["42.2 Data"]
  N3["42.3 Findings"]
  N4["42.4 Literature"]
  N5["Method details"]
  N6["Ethics"]
  N7["Sharing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX124"]

[Learning outcomes]
    |
    v
[42.1 Question]
    |
    v
[42.2 Data]
    |
    v
[42.3 Findings]
    |
    v
[42.4 Literature]
    |
    v
[Method details]
    |
    v
[Ethics]
    |
    v
[Sharing]
    |
    v
[Worked example] --> [Exercise EX124]

Learning outcomes

You will (1) ask a research question from the project; (2) collect data; (3) relate findings to literature.

42.1 Question

Does nightly restore reduce help-desk calls about public PCs?

The question came from Marta, who wanted to know whether the project had reduced the calls her team handled, not only the problems in the logs. It can be answered from records Fernhill already keeps, without collecting new data about patrons. Mateo writes it as a single question with a clear measure: the number of calls per month, grouped by topic, before and after the change. Broader questions, such as patron satisfaction, are left for comment cards.

42.2 Data

Call logs for three months before and after deployment, categorised by topic.

The help desk logs each call with a date and a short description written by staff. Mateo strips any names or card numbers before analysis, keeping only the date and the description. Three months on each side of deployment covers a full term in each period. Categorising the descriptions is the step where judgment enters, which is why two people code a sample independently, as the method details below explain.

42.3 Findings

Calls about slow or broken PCs fall by about half; calls about saving work rise slightly.

The drop in calls about slow or broken PCs fits what the availability estimate predicted: fewer failures last long enough for a patron to report them. The rise in calls about saving work was not predicted, though the first studio had raised the question. Mateo reports both, with the counts behind each change, rather than presenting only the favourable result. The rise led directly to a design change.

42.4 Literature

Forrest et al. (1996) proposed defining normal behaviour of Unix processes to detect anomalies; Mateo notes that a fixed image makes "normal" easier to define, supporting future monitoring work.

The connection is indirect but useful. On a PC that changes every day, normal behaviour is hard to describe, so unusual behaviour is hard to spot. A PC that returns to the same image each night behaves much the same from one day to the next, which could make a simple model of normal practical. Mateo does not test the idea; he records it as a direction for future work.

42.5 Limits

Other changes, such as new staff, may also affect calls.

Mateo lists the other changes he knows about in the two periods: a new technician joined, one branch changed its opening hours and a new browser version was released. Any of these could affect call numbers. He cannot remove their influence, but he can say which direction each might push the result. That is enough for Fernhill to treat the finding as useful evidence rather than proof of cause. He says so plainly.

Method details

Calls are categorised by a librarian and an IT technician separately for a sample of 100 calls, agreeing on 91. Disagreements are discussed and the category rules clarified. Mateo compares three months before deployment with three months after, excluding the deployment month itself.

He reports counts by category with percentages and notes that the number of sessions was similar in both periods, which supports comparison.

Ethics

Call records are anonymised before analysis; only categories and dates are used.

Sharing

Results are shared with Fernhill and the studio.

Link to design

The findings lead to the clearer notice and print-to-PDF guide, closing the loop between research and design.

Future research

Mateo suggests studying whether a fixed image makes anomaly monitoring practical.

Limitations

The study covers one network and six months.

Validity

Two coders reduce bias in categories.

Next steps

A longer study could track seasonal effects.

Presentation

Mateo presents the study at the institute's student research day, with a poster showing call categories before and after.

Data storage

Data are deleted after analysis.

Worked example

The rise in saving-work calls leads to a clearer notice and a print-to-PDF guide.

Synthetic case. Synthetic.

Errors and limits

Before-and-after studies cannot exclude other causes.

Exercises

Synthesis

Small research questions from practice improve designs.

Continue studying — chapter 42 of 50

← Chapter 41 (draft) · Course chapter index · Chapter 43 (draft) →