OpenCyber AcademyLearning outcomes
You will (1) turn an operational problem into a researchable question; (2) search and screen literature systematically; (3) define terms precisely.
1.1 The problem
Chloé Dubois is a master's student at the fictional Redbourne University, supervised by Dr Arjun Mehta. Her study partner is the fictional Halvorsen Engineering, a manufacturer with 600 Windows laptops managed centrally. Halvorsen applies a security baseline derived from the CIS Benchmarks and Microsoft's security baselines, yet its quarterly reports show that about a quarter of laptops drift away from it. The IT manager, Sven Halvorsen, wants to know why, because each explanation suggests a different fix.
Sven's three candidate fixes cost very different amounts: removing admin rights, changing how remote laptops refresh policy, or reworking engineering software.
1.2 The question
Chloé asks: which device and user characteristics are associated with baseline drift on Halvorsen's laptops? She defines drift as any baseline setting differing from its required value at the monthly check.
"Any setting" is deliberately strict: a screen lock of 15 minutes counts as drift against a ten-minute requirement, just as a disabled firewall does. Chloé keeps the strict definition for the main outcome and records which settings drifted, so that a laptop with only a slightly long screen lock can be told apart from one with encryption off. "At the monthly check" fixes when drift is measured, which matters later: a change made and reverted within a month is never seen.
1.3 Literature method
She searches digital libraries with fixed terms, records the date and counts, screens titles and abstracts against inclusion criteria, and keeps a log so another person could repeat the search.
Her log records each database, the exact search string, the date run, hits, titles screened, abstracts screened and works included, with a reason for every exclusion. That matters for a topic like configuration drift, where vendor white papers vastly outnumber studies; the log shows the examiner which strand each included source came from, and lets Dr Mehta check that no inconvenient study was quietly dropped.
1.4 Key sources
NIST SP 800-128 describes security-focused configuration management, including baselines and monitoring for unauthorised change. CIS Controls v8 lists secure configuration of enterprise assets as a core safeguard. Dietrich et al. (2018) show that operators often explain misconfigurations by time pressure and unclear responsibility.
The three sources point at different explanations. SP 800-128's emphasis on monitoring for unauthorised change fits Explanation A, users changing settings. CIS Controls' focus on secure configuration and administrative privileges also fits A. Dietrich et al.'s finding about time pressure and unclear responsibility suggests why admin rights get granted widely in the first place, which Chloé returns to in her discussion.
1.5 Defining terms
She distinguishes drift (a change after compliance) from never-compliant devices, which point to deployment problems rather than drift.
The distinction changes the fix. A laptop that never met the baseline points to the imaging or enrolment process at Halvorsen, and adding monitoring would not help it. A laptop that met the baseline and then moved away points to something in daily use: a user with admin rights, a missed policy refresh or software that needs a different setting. Chloé's study is about the second group, so she flags never-compliant laptops at the first monthly check and reports them separately rather than counting them as drift.
Scope
The study covers laptops only, not servers or phones.
Worked example
Dr Mehta asks why her question says "associated with" rather than "causes". Chloé explains that she will observe existing records without changing anything, so she can show association, and will discuss causation only with care.
Synthetic case. Chloé, Dr Mehta, Sven and Halvorsen are synthetic.
Errors and limits
A vague definition of drift would let the result depend on how settings are counted.
Exercises
- EX001 — Problem. What operational problem started the study?
Show marking criteria
Rubric: 3 = ~quarter of laptops drift from baseline; 2 = partial; 1 = vague; 0 = none. - EX002 — Question wording. State Chloé's research question.
Show marking criteria
Rubric: 3 = characteristics associated with drift; 2 = partial; 1 = vague; 0 = none. - EX003 — Drift definition. How is drift defined?
Show marking criteria
Rubric: 3 = any setting differs at monthly check; 2 = partial; 1 = vague; 0 = none. - EX004 — Search log. Why keep a search log?
Show marking criteria
Rubric: 3 = repeatability; 2 = partial; 1 = vague; 0 = none. - EX005 — SP 800-128. What does SP 800-128 contribute?
Show marking criteria
Rubric: 3 = baselines and change monitoring; 2 = partial; 1 = vague; 0 = none. - EX006 — Never-compliant. Why separate never-compliant devices?
Show marking criteria
Rubric: 3 = deployment problem not drift; 2 = partial; 1 = vague; 0 = none. - EX007 — Association. Why say "associated with"?
Show marking criteria
Rubric: 3 = observational design; 2 = partial; 1 = vague; 0 = none.
Synthesis
A precise question and repeatable search set up the study.