Chapter 1 — Research question and literature method
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The student and the setting"]
N2["1.2 Framing the question"]
N3["1.3 Searching the literature"]
N4["1.4 Recording decisions"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The student and the setting"]
N2["1.2 Framing the question"]
N3["1.3 Searching the literature"]
N4["1.4 Recording decisions"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The student and the setting]
|
v
[1.2 Framing the question]
|
v
[1.3 Searching the literature]
|
v
[1.4 Recording decisions]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame an answerable information security research question; (2) run a structured literature search; (3) record inclusion decisions so others can repeat them.
1.1 The student and the setting
Priya Natarajan starts a two-year master's programme in information security at the fictional Ashcombe University, supervised by Dr. Olumide Bello. Her partner organisation is the fictional Harrowgate Community Health, which employs about 2,400 staff across six departments and runs a phishing simulation every quarter. The security team is debating whether to replace once-a-year awareness training with immediate feedback shown when a person clicks a simulated phishing link. Priya sees a chance to answer a practical question with real organisational evidence. Dr. Bello agrees to supervise the project.
1.2 Framing the question
Priya's first draft asks whether training makes staff more secure. Dr. Bello points out that secure is not measurable and training is not specific. She rewrites it: in departments that adopt just-in-time feedback, does the share of staff clicking simulated phishing links fall more than in departments keeping annual training only? The revised question names the intervention, the outcome, the comparison and the population, so she can decide in advance what evidence would answer it and what would not. Dr. Bello approves the revised wording.
1.3 Searching the literature
Priya searches two academic databases and the publications of national standards bodies, using fixed search strings combining phishing, simulation, training and feedback. She restricts results to studies reporting measured behaviour rather than opinions, because her question concerns clicks rather than attitudes. She also reads general texts, including Anderson's Security Engineering, whose discussion of psychology and usability warns that blaming users rarely fixes systems. That warning shapes how she later frames the ethics of her study and its recommendations. She keeps a dated record of every search.
1.4 Recording decisions
Every inclusion and exclusion is logged in a spreadsheet with the reason, such as no behavioural measure, no comparison group or simulation conducted only in a laboratory. Dr. Bello asks her to keep the search strings and dates so another student could repeat the search and reach the same list. Priya ends with twenty-three included studies. She notes that many report large effects from single organisations without comparison groups, which makes her more cautious about expecting a large effect herself. The spreadsheet is archived.
Worked example
Priya narrows a vague question to a measurable comparison of click rates between feedback and annual-training departments, then runs and logs a repeatable literature search.
Synthetic case. Priya, Ashcombe and Harrowgate are synthetic.
Errors and limits
A question about whether staff are secure cannot be answered with any measure.
Exercises
- EX001 — Partner size. How many staff does Harrowgate employ? Rubric: 3 = about 2,400;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX002 — Revised question. What is Priya's revised question? Rubric: 3 = whether feedback departments' click rates fall more than comparison;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX003 — Four elements. Which four elements does the revised question name? Rubric: 3 = intervention, outcome, comparison, population;; 2 = all;; 1 = some;; 0 = none.
- EX004 — Inclusion restriction. Which studies does Priya include? Rubric: 3 = those measuring behaviour;; 2 = partly correct;; 1 = opinions;; 0 = none.
- EX005 — Anderson warning. What warning does Anderson's text give? Rubric: 3 = blaming users rarely fixes systems;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX006 — Logged reasons. Give an exclusion reason Priya logs. Rubric: 3 = no behavioural measure;; 2 = one;; 1 = vague;; 0 = none.
- EX007 — Included count. How many studies are included? Rubric: 3 = twenty-three;; 2 = partly correct;; 1 = wrong;; 0 = none.
Continue studying — lesson 01 (chapter 01 of 08)
← Course home · Course chapter index · Chapter 02 →
Continue to the next authored lesson.