Chapter 1 — Research question and literature method
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 From problem to question"]
N3["1.3 Shared vocabulary"]
N4["1.4 Search method"]
N5["1.5 Grey literature"]
N6["1.6 Developer behaviour"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 From problem to question"]
N3["1.3 Shared vocabulary"]
N4["1.4 Search method"]
N5["1.5 Grey literature"]
N6["1.6 Developer behaviour"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 From problem to question]
|
v
[1.3 Shared vocabulary]
|
v
[1.4 Search method]
|
v
[1.5 Grey literature]
|
v
[1.6 Developer behaviour]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) turn a practical application-security problem into a researchable question; (2) search and screen literature systematically; (3) use OWASP and CWE as shared vocabularies; (4) record the search so others can repeat it.
1.1 The case
Sofia Almeida is a master's student at the fictional Kingsreach University, supervised by Dr Marcus Lee. She works part-time at the fictional fintech Tallyline, whose web app lets small businesses send invoices and issue refunds. Over a year, penetration tests kept finding the same kind of flaw: users able to see or change records they should not. In March, a customer could view another business's invoice by changing a number in the address. The fix worked, but a similar flaw reappeared two releases later in the refunds feature.
1.2 From problem to question
"Why do we keep getting this?" becomes: "Do automated authorisation tests derived from an explicit role matrix reduce the reintroduction of broken access control in a web application, and what else explains the change?" The question names an intervention, an outcome and a demand for alternative explanations.
The second half of the question matters as much as the first. Tallyline changed more than its tests during the study period, and a question that asked only whether findings fell would invite Sofia to credit the tests with everything. Asking what else explains the change commits her, before any data, to look for rival causes such as the framework upgrade.
1.3 Shared vocabulary
The OWASP Top 10:2021 ranks Broken Access Control (A01) first; the CWE Top 25 lists related weaknesses such as missing authorisation (CWE-862) and authorisation bypass through a user-controlled key (CWE-639). OWASP ASVS 4.0.3 chapter V4 and ASVS 5.0.0's authorisation chapter give verifiable requirements. Using these names lets Sofia's findings be compared with others.
The March flaw maps cleanly onto this vocabulary: changing a number in the address to view another business's invoice is CWE-639, and the refunds flaw two releases later is a case of missing authorisation, CWE-862. Recording both identifiers for each finding lets Sofia's counts be compared with published data on the same weaknesses.
1.4 Search method
Sofia searches two digital libraries and the OWASP project pages with terms for access control, authorisation testing and regression. She records the date, database, query and number of hits, screens titles and abstracts against inclusion criteria (empirical, web applications, access control), and keeps a log of exclusions with reasons.
Her log turned 412 records into 38 after title screening and 11 after full text. Only two of the eleven studied authorisation regression in web applications directly, and none used role-matrix tests in a real team. Because each exclusion has a reason in the log, Dr Lee could accept that gap as defensible rather than as a sign that the search was too narrow.
1.5 Grey literature
Standards and testing guides such as the OWASP Web Security Testing Guide (WSTG v4.2) are not peer-reviewed research but define practice; Sofia uses them for definitions, not as evidence of effectiveness.
In practice, the WSTG supplies the description of how to test each role against each endpoint, which Sofia's matrix tests follow. It cannot tell her whether doing so reduces recurring flaws; that is what her twelve releases are for. Keeping the two uses apart prevents a testing guide from being cited as evidence for an effect it never measured.
1.6 Developer behaviour
Johnson et al. (2013) found developers avoid static analysis tools that produce many false positives and poor explanations; Sofia notes that any test approach must be usable by Tallyline's developers, or it will be ignored.
This shapes the design of Sofia's tests. Each failing test names the role, the endpoint and the intended decision, so a developer can see at once that, for example, support should not be able to issue refunds. Developers later reported finding the failures clear, which is the usability Johnson et al. found missing in static tools.
Worked example
Sofia's search log: 412 records, 38 after title screening, 11 after full text. Only two study authorisation regression in web apps directly; none use role-matrix tests in a real team. Dr Lee accepts this as a defensible gap for a master's dissertation.
Synthetic case. Kingsreach University, Tallyline, its staff and all data are synthetic.
Errors and limits
Small literatures can reflect search limits; report the search fully so readers can judge.
Exercises
- EX001 — The problem. What problem triggered the study? Rubric: 3 = access-control flaws recurring; invoice view; refunds two releases later; 2 = partial; 1 = vague; 0 = none.
- EX002 — Question parts. Name the parts of Sofia's question. Rubric: 3 = intervention, outcome, alternative explanations; 2 = two; 1 = one; 0 = none.
- EX003 — OWASP rank. Where does broken access control rank in the OWASP Top 10:2021? Rubric: 3 = A01, first; 2 = one; 1 = vague; 0 = none.
- EX004 — CWE names. Give two CWE entries related to the case. Rubric: 3 = CWE-862, CWE-639; 2 = one; 1 = vague; 0 = none.
- EX005 — Search log. What does the search log record? Rubric: 3 = date, database, query, hits, exclusions with reasons; 2 = partial; 1 = vague; 0 = none.
- EX006 — Grey literature. How does Sofia use WSTG? Rubric: 3 = definitions not effectiveness evidence; 2 = partial; 1 = vague; 0 = none.
- EX007 — Usability warning. What did Johnson et al. (2013) find? Rubric: 3 = developers avoid tools with false positives, poor explanations; 2 = partial; 1 = vague; 0 = none.
Synthesis
Ask a question with an intervention, an outcome and alternatives, and search in a way others can repeat.