Chapter 1 — Research question and literature method

Learning outcomes

You will (1) frame an answerable information security research question; (2) run a structured literature search; (3) record inclusion decisions so others can repeat them.

1.1 The student and the setting

Priya Natarajan starts a two-year master's programme in information security at the fictional Ashcombe University, supervised by Dr. Olumide Bello. Her partner organisation is the fictional Harrowgate Community Health, which employs about 2,400 staff across six departments and runs a phishing simulation every quarter. The security team is debating whether to replace once-a-year awareness training with immediate feedback shown when a person clicks a simulated phishing link. Priya sees a chance to answer a practical question with real organisational evidence. Dr. Bello agrees to supervise the project.

1.2 Framing the question

Priya's first draft asks whether training makes staff more secure. Dr. Bello points out that secure is not measurable and training is not specific. She rewrites it: in departments that adopt just-in-time feedback, does the share of staff clicking simulated phishing links fall more than in departments keeping annual training only? The revised question names the intervention, the outcome, the comparison and the population, so she can decide in advance what evidence would answer it and what would not. Dr. Bello approves the revised wording.

1.3 Searching the literature

Priya searches two academic databases and the publications of national standards bodies, using fixed search strings combining phishing, simulation, training and feedback. She restricts results to studies reporting measured behaviour rather than opinions, because her question concerns clicks rather than attitudes. She also reads general texts, including Anderson's Security Engineering, whose discussion of psychology and usability warns that blaming users rarely fixes systems. That warning shapes how she later frames the ethics of her study and its recommendations. She keeps a dated record of every search.

1.4 Recording decisions

Every inclusion and exclusion is logged in a spreadsheet with the reason, such as no behavioural measure, no comparison group or simulation conducted only in a laboratory. Dr. Bello asks her to keep the search strings and dates so another student could repeat the search and reach the same list. Priya ends with twenty-three included studies. She notes that many report large effects from single organisations without comparison groups, which makes her more cautious about expecting a large effect herself. The spreadsheet is archived.

Worked example

Priya narrows a vague question to a measurable comparison of click rates between feedback and annual-training departments, then runs and logs a repeatable literature search.

Synthetic case. Priya, Ashcombe and Harrowgate are synthetic.

Errors and limits

A question about whether staff are secure cannot be answered with any measure.

Exercises

• EX001 — Partner size. How many staff does Harrowgate employ?
  Show marking criteria

  Rubric: 3 = about 2,400;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX002 — Revised question. What is Priya's revised question?
  Show marking criteria

  Rubric: 3 = whether feedback departments' click rates fall more than comparison;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX003 — Four elements. Which four elements does the revised question name?
  Show marking criteria

  Rubric: 3 = intervention, outcome, comparison, population;; 2 = all;; 1 = some;; 0 = none.
• EX004 — Inclusion restriction. Which studies does Priya include?
  Show marking criteria

  Rubric: 3 = those measuring behaviour;; 2 = partly correct;; 1 = opinions;; 0 = none.
• EX005 — Anderson warning. What warning does Anderson's text give?
  Show marking criteria

  Rubric: 3 = blaming users rarely fixes systems;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX006 — Logged reasons. Give an exclusion reason Priya logs.
  Show marking criteria

  Rubric: 3 = no behavioural measure;; 2 = one;; 1 = vague;; 0 = none.
• EX007 — Included count. How many studies are included?
  Show marking criteria

  Rubric: 3 = twenty-three;; 2 = partly correct;; 1 = wrong;; 0 = none.