Chapter 1 — Research question and literature method
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 From interest to question"]
N2["1.2 Why this question works"]
N3["1.3 Designing the search"]
N4["1.4 Screening and recording"]
N5["Lab — Screening flow counts"]
N6["1.5 What the literature says"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 From interest to question"]
N2["1.2 Why this question works"]
N3["1.3 Designing the search"]
N4["1.4 Screening and recording"]
N5["Lab — Screening flow counts"]
N6["1.5 What the literature says"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 From interest to question]
|
v
[1.2 Why this question works]
|
v
[1.3 Designing the search]
|
v
[1.4 Screening and recording]
|
v
[Lab — Screening flow counts]
|
v
[1.5 What the literature says]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) turn an architecture interest into a focused, answerable question; (2) design a documented literature search; (3) screen sources with explicit criteria; (4) record the search so others can repeat it.
1.1 From interest to question
Kenji Albrecht is a master's student at the fictional Northmoor University, supervised by Dr Selin Aydın. He works part-time for the fictional Vantor Logistics, whose flat internal network lets almost any workstation reach almost any server. His interest is zero trust architecture, described in NIST SP 800-207, but an interest is not a question. Dr Aydın pushes him to narrow it. After several drafts he settles on this: in simulated enterprise networks shaped like Vantor's, how much does identity-based micro-segmentation reduce the number of servers an attacker can reach from one compromised workstation, compared with zone-based segmentation? Every person, organisation and network here is synthetic.
1.2 Why this question works
The question names a population, simulated networks shaped like a real type of enterprise; an intervention, identity-based micro-segmentation; a comparison, zone-based segmentation; and an outcome, reachable servers from one foothold. It can be answered within a master's timeline because it uses simulation rather than changing a production network, and it avoids the ethical and operational risks of testing on live systems. It is also limited: reachability is a proxy for attacker progress, not a measure of real incidents. Kenji writes this limitation into the question document now, so it shapes every later chapter rather than appearing only at the end.
1.3 Designing the search
Kenji designs his search before running it. He chooses databases, the IEEE and ACM digital libraries plus NIST publications, and writes search strings combining terms for segmentation, zero trust and lateral movement. He sets inclusion criteria: peer-reviewed studies or official standards from 2010 onward that discuss network segmentation effects on attacker movement. He excludes vendor marketing and opinion pieces, while keeping a separate list of grey literature for context. Writing criteria first prevents him from unconsciously including only studies that agree with what he expects to find, which is a well-known bias in literature reviews.
1.4 Screening and recording
His search returns 312 records. Screening titles and abstracts removes those outside scope, and full-text reading removes more. He records the number at each stage, the reasons for exclusion and the date of each search, in a flow table similar to those used in systematic reviews. The lab below reproduces the counts from his screening log. The final set of 27 studies is small, and he notes that most report designs or simulations rather than field measurements. Recording the search makes it repeatable, and it lets examiners judge whether important work could have been missed.
Lab — Screening flow counts
# Screening flow from a synthetic search log.
log = {"ieee": 141, "acm": 118, "nist": 53}
dupes = 46; title_abstract_out = 197; fulltext_out = 42
total = sum(log.values()); after_d = total - dupes
after_ta = after_d - title_abstract_out; included = after_ta - fulltext_out
for k, v in log.items(): print(f"source {k:5} {v}")
print(f"records {total} -> after duplicates {after_d} -> after title/abstract {after_ta} -> included {included}")
Run with python3 lab_screen.py. Verified output:
source ieee 141
source acm 118
source nist 53
records 312 -> after duplicates 266 -> after title/abstract 69 -> included 27
1.5 What the literature says
Kenji summarises themes. Foundational principles, including least privilege and complete mediation from Saltzer and Schroeder (1975), underpin segmentation. NIST SP 800-207 describes policy enforcement points that make access decisions per request. Anderson (2020) gives case studies where flat networks let attackers move widely after one compromise. Simulation studies of attack graphs exist, but few compare segmentation strategies on the same networks with the same assumptions. That gap shapes his contribution: a controlled comparison under stated assumptions, not a claim about how real attackers will behave in every enterprise.
Worked example
Kenji narrows his interest to a reachability question, writes search strings and criteria in advance, screens 312 records to 27 studies with a flow table and identifies the comparison gap.
Synthetic case. Northmoor University, Vantor Logistics, Kenji, Dr Aydın and screening numbers are invented; SP 800-207, Saltzer and Schroeder (1975) and Anderson (2020) are real.
Errors and limits
Database choice limits coverage; practitioner knowledge may sit outside indexed literature. Reachability ignores detection and response.
Exercises
- EX001 — Question parts. Name the population, intervention, comparison and outcome in Kenji's question. Rubric: 3 = simulated Vantor-like networks; identity micro-segmentation; zone segmentation; reachable servers from one foothold;; 2 = three;; 1 = vague;; 0 = none.
- EX002 — Simulation choice. Why use simulation instead of changing Vantor's network? Rubric: 3 = fits the timeline and avoids ethical and operational risks to live systems;; 2 = one reason;; 1 = no reason;; 0 = none.
- EX003 — Proxy limit. What limitation does Kenji write into the question document? Rubric: 3 = reachability is a proxy for attacker progress, not real incidents;; 2 = proxy;; 1 = vague;; 0 = none.
- EX004 — Criteria first. Why write inclusion criteria before searching? Rubric: 3 = to prevent selectively including agreeable studies;; 2 = bias;; 1 = no reason;; 0 = none.
- EX005 — Screening lab. How many records entered screening and how many studies were included? Rubric: 3 = 312 records, 27 included;; 2 = one number;; 1 = wrong;; 0 = none.
- EX006 — Flat-network evidence. What does Anderson (2020) contribute to Kenji's review? Rubric: 3 = case studies where flat networks allowed wide movement after one compromise;; 2 = cases;; 1 = vague;; 0 = none.
- EX007 — Comparison gap. What gap did Kenji identify? Rubric: 3 = few studies compare segmentation strategies on the same networks under the same assumptions;; 2 = gap;; 1 = vague;; 0 = none.
Synthesis
A good master's question is narrow, answerable and honest about its proxy, and a recorded literature search shows where it adds something new.