Chapter 1 — Research question and literature method
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 From placement to question"]
N2["1.2 Literature method"]
N3["1.3 Related-work map"]
N4["1.4 Choosing a measure"]
N5["1.5 Asset context"]
N6["1.5b Note hygiene"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 From placement to question"]
N2["1.2 Literature method"]
N3["1.3 Related-work map"]
N4["1.4 Choosing a measure"]
N5["1.5 Asset context"]
N6["1.5b Note hygiene"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 From placement to question]
|
v
[1.2 Literature method]
|
v
[1.3 Related-work map]
|
v
[1.4 Choosing a measure]
|
v
[1.5 Asset context]
|
v
[1.5b Note hygiene]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) turn a workplace observation into a research question; (2) search and organise literature on red-team methodology and reporting; (3) write a one-page related-work map; (4) choose a measure of remediation uptake; and (5) keep notes that separate claims from evidence.
1.1 From placement to question
Noah notices that some findings are fixed quickly and others linger. A researchable form asks whether a reporting choice — tagging each finding with MITRE ATT&CK technique IDs — changes remediation completion within 30 days on CBM's synthetic training segments.
The workplace observation is not yet a question: it names no comparison, no time limit and no data source. Noah's version fixes all three. The intervention is ATT&CK tagging, the comparison is narrative-only text, and the measure is completion within 30 days in CBM's ticket system. Because the segments are synthetic training segments, the question also states its own limit on generalisation.
1.2 Literature method
Search PTES, NIST SP 800-115, ATT&CK documentation, OWASP WSTG, TIBER-EU and CBEST materials, plus academic critiques of security scoring (Albrecht and Jensen, arXiv:2010.06377). For each source, capture: claim, method, measure, limits, relevance to reporting.
A five-field note keeps each source honest. For NIST SP 800-115, the claim is that assessments need planning through reporting, the method is process guidance, and the limit is that it offers no measured remediation outcomes. Record the search strings and date for each database you use, so the search can be repeated when the frameworks are updated before submission.
1.3 Related-work map
Cluster sources into: engagement methodology; threat-led frameworks; web testing cases; reporting and scoring critiques; blue-team remediation studies. Your gap should sit at an intersection — for Noah, reporting format × remediation uptake.
Noah's map shows many sources on reporting guidance and some on remediation, but few that compare ATT&CK tags with narrative text on completion. That empty intersection is his gap. Draw the map as one page, with each source placed in a cluster, so a supervisor can see at a glance whether the gap is real or whether a cluster has not been searched.
1.4 Choosing a measure
Remediation completion within 30 days is observable in CBM's ticket system for synthetic findings. Avoid measures you cannot see (attacker 'skill') or that invent a single security score.
For Noah, remediated means closed with verifying evidence attached and not reopened within 30 days, checked by someone blind to the hypothesis. That definition can be applied to every ticket the same way. A measure such as 'risk reduced' cannot, because nobody could check it from the data, and examiners would ask how it was observed.
1.5 Asset context
Before studying reports, know what is being assessed. Rank synthetic assets by exposure, data sensitivity and blast radius so the dissertation's scenarios are realistic.
"""Rank synthetic assets for authorized engagement scoping."""
assets = [
("public-web-portal", 3, 3, 3), # exposure, data_sensitivity, blast_radius 1-3
("staging-admin-ui", 2, 3, 2),
("corp-vpn-edge", 3, 2, 3),
("internal-wiki", 1, 2, 1),
("printer-fleet", 2, 1, 1),
("lab-jump-host", 1, 1, 2),
]
print(f"{'asset':20} score exposure data blast")
for name, e, d, b in sorted(assets, key=lambda x: -(x[1]+x[2]+x[3])):
print(f"{name:20} {e+d+b:5} {e:8} {d:4} {b:5}")
Expected output:
asset score exposure data blast
public-web-portal 9 3 3 3
corp-vpn-edge 8 3 2 3
staging-admin-ui 7 2 3 2
internal-wiki 4 1 2 1
printer-fleet 4 2 1 1
lab-jump-host 4 1 1 2
The inventory lab adds exposure, data sensitivity and blast radius, each from 1 to 3. The public web portal scores 9, the VPN edge 8 and the staging admin UI 7, while the internal wiki, printer fleet and lab jump host score 4. Scenarios built around the higher-scoring assets reflect where CBM schedules its training assessments first. The three lowest assets tie at 4, so their order is arbitrary.
1.5b Note hygiene
Keep a research log that separates quotations, paraphrases and your own claims. Record search strings and dates so literature updates can be repeated. When a source is a living framework (ATT&CK, WSTG), note the version or access date beside every citation.
Noah's log also records which sources changed his mind and why. When a framework releases a new version during the dissertation, the access dates show which citations need checking. Mark each claim in your notes with its source, so a reader can tell your view from the author's. This saves hours when writing the related-work chapter.
1.6 Worked example (synthetic CBM case)
Noah's question: On CBM synthetic segments, do ATT&CK-tagged findings have a higher 30-day remediation rate than narrative-only findings? The inventory lab ranks public-web-portal highest (score 9), matching where CBM schedules training assessments first.
The question names the setting, the comparison and the measure, so it can be answered with ticket data. The asset ranking keeps the study close to how CBM actually works, which matters when examiners ask whether the scenarios were realistic. Both appear in the first chapter of Noah's dissertation, with the lab output as evidence.
1.7 Errors and limits
- Questions that only praise a tool.
- Literature notes that copy abstracts.
- Measures with no data source.
Each error weakens the dissertation from the start. A question that only praises a tool assumes its answer and cannot be falsified. Notes that copy abstracts lose the method and limits that decide whether a source supports your claim. A measure with no data source cannot be collected, however interesting it sounds, and the problem appears only when collection starts. Check your first chapter for all three before your supervisor reads it.
Exercises
- EX001 — Observation — Turn Noah's observation into a falsifiable question. Rubric: 3 = population, intervention, measure; 2 = two; 1 = vague; 0 = none.
- EX002 — Note — Write a five-field note on NIST SP 800-115. Rubric: 3 = claim, method, measure, limits, relevance; 2 = four; 1 = two; 0 = none.
- EX003 — Map — Place five sources on the related-work map. Rubric: 3 = five clustered; 2 = four; 1 = two; 0 = none.
- EX004 — Measure — Justify 30-day remediation completion. Rubric: 3 = observable, timed, relevant; 2 = two; 1 = one; 0 = none.
- EX005 — Inventory lab — Why does public-web-portal outrank lab-jump-host? Rubric: 3 = exposure/data/blast; 2 = partial; 1 = vague; 0 = wrong.
- EX006 — Gap — State Noah's gap in three sentences. Rubric: 3 = prior, gap, contribution; 2 = two; 1 = one; 0 = none.
- EX007 — Ethics seed — List two ethics constraints already implied. Rubric: 3 = synthetic only, authorization; 2 = one; 1 = vague; 0 = none.
Synthesis
Seminar and literature habits turn red-team practice into researchable questions with ethical boundaries.