Chapter 1 — Research question and literature method

Learning outcomes

You will (1) turn a workplace problem into a research question; (2) run a structured literature search; (3) record sources so the search can be repeated.

1.1 From problem to question

Sofia Lindqvist is a master's student at the fictional Harrowgate Institute, supervised by Dr Paul Nakamura. She works part time in the IT department of the fictional Orchard Lane Hospital Trust, where staff must change passwords every sixty days and the help desk handles hundreds of resets a month. Clinical staff complain that the rules waste time during shifts. Sofia turns the complaint into a question: after the trust stopped forced periodic changes and offered a password manager, did reset requests fall, and did staff report less password reuse?

1.2 Why the question matters

Sofia explains to Dr Nakamura why the question is worth a dissertation. Adams and Sasse (1999) found that demanding password rules led staff to write passwords down and reuse them, because the rules ignored how people actually work. Forced changes are a common example of a rule whose costs are visible every day while its benefits are uncertain. If the trust's change reduced burden without new risks, other hospitals could learn from it. If it did not, that would also be useful evidence for policy makers deciding on password rules.

1.3 A structured search

Sofia searches two academic databases and one standards collection using planned terms: password policy, password expiration, password manager, usable security and help desk. She records the date, database, search string and number of results for each search. She screens titles and abstracts against written inclusion rules: empirical studies or official guidance on workplace passwords. She keeps a table of excluded items with reasons. Dr Nakamura stresses that a repeatable search protects her review from the charge that she only cited studies supporting her view.

1.4 What the search found

Sofia's search returns a manageable set of sources. Key works include Adams and Sasse (1999), Sasse, Brostoff and Weirich (2001) on designing usable security, Herley (2009) on users rationally rejecting costly advice, and Beautement, Sasse and Wonham (2008) on the compliance budget. She also finds NIST and national guidance that has moved away from routine forced changes, which she notes as context rather than evidence of effect. She records gaps: few studies measure what happens in a hospital after such a policy change. She saves the full search log as an appendix to the dissertation.

Worked example

Sofia turns a complaint into a before-and-after research question, justifies it, runs a recorded search with inclusion rules and summarises key sources and gaps.

Synthetic case. Harrowgate, Orchard Lane and all people are synthetic; the cited works are real.

Errors and limits

Database searches miss grey literature. Guidance documents state positions rather than measured effects.

Exercises

• EX001 — Research question. What research question did Sofia form?
  Show marking criteria

  Rubric: 3 = after ending forced changes and offering a manager, did resets fall and reuse reports drop?;; 2 = two outcomes;; 1 = vague;; 0 = none.
• EX002 — Adams and Sasse relevance. Why is Adams and Sasse (1999) relevant?
  Show marking criteria

  Rubric: 3 = demanding rules led to writing down and reuse;; 2 = workarounds;; 1 = vague;; 0 = none.
• EX003 — Search record. What does Sofia record for each search?
  Show marking criteria

  Rubric: 3 = date, database, search string and result count;; 2 = three;; 1 = vague;; 0 = none.
• EX004 — Excluded items. Why keep a table of excluded items?
  Show marking criteria

  Rubric: 3 = so the search can be repeated and is not seen as selective;; 2 = transparency;; 1 = vague;; 0 = none.
• EX005 — Guidance as context. Why treat official guidance as context, not evidence?
  Show marking criteria

  Rubric: 3 = it states positions rather than measured effects;; 2 = positions;; 1 = evidence;; 0 = none.
• EX006 — Gap found. What gap did Sofia record?
  Show marking criteria

  Rubric: 3 = few studies measure effects in a hospital after such a change;; 2 = hospital;; 1 = vague;; 0 = none.
• EX007 — Herley's point. Which source argues users rationally reject costly advice?
  Show marking criteria

  Rubric: 3 = Herley (2009);; 2 = Herley;; 1 = Whitten;; 0 = none.

Synthesis

A focused question and a recorded, repeatable search give a dissertation a defensible starting point.

Continue studying — chapter 01 of 08

← Course home · Course chapter index · Chapter 02 (draft) →