OpenCyber Academy
Postgraduate · Chapter 10 · English
Course code: OCA-144Chapter 10: OCA-144-C010

Chapter 10 — Research reading and critique

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 10 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Critical reading"]
  N2["10.2 Structured critique"]
  N3["10.3 Implications"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Critical reading"]
  N2["10.2 Structured critique"]
  N3["10.3 Implications"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]

[Learning outcomes]
    |
    v
[10.1 Critical reading]
    |
    v
[10.2 Structured critique]
    |
    v
[10.3 Implications]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) read research papers critically; (2) write a structured critique; (3) identify implications for practice.

10.1 Critical reading

Daniel reads three papers closely: Sasse, Brostoff and Weirich (2001) on transforming the weakest link, Beautement, Sasse and Wonham (2008) on the compliance budget and Lain, Kostiainen and Čapkun (2022) on phishing in organisations. For each he notes the question, methods, findings and limits, and asks whether the conclusions follow from the evidence. He reads the methods sections carefully, because summaries in other sources often overstate findings or omit limits that the authors themselves stated clearly. He keeps a reading log with one page of notes for each paper and its limits.

10.2 Structured critique

Daniel writes a critique of the compliance budget paper. He summarises its argument that staff weigh security effort against business goals and have limited capacity for compliance. He notes strengths: grounded in interviews across organisations, the concept explains many observed behaviours. He notes limits: the budget is hard to measure directly and the paper offers a framework rather than tested predictions. He concludes that the concept is useful for design decisions, provided managers treat it as a lens rather than a precise quantity.

10.3 Implications

From his reading, Daniel draws implications for Calloway: design to reduce effort; measure burden alongside outcomes; favour collective reporting over individual perfection; and treat simulations cautiously, as evidence suggests some common practices add little. He writes these into the programme charter with citations. Critique is valuable not for finding fault but for understanding how far each study can support decisions, which protects practice from both blind faith and dismissal of research. The governance panel reviews the charter changes and approves them after a short discussion with HR.

Worked example

Daniel reads three papers critically, critiques the compliance budget paper and writes four implications into Calloway's charter.

Synthetic case. Cited works are real; Calloway is synthetic.

Errors and limits

Critique can drift into fault-finding. Implications may stretch evidence.

Exercises

Synthesis

Critical reading weighs what studies can support and translates them carefully into practice.

Continue studying — chapter 10 of 12

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →

Worked answers

EX046. Because other summaries often overstate findings or omit stated limits.

EX047. It is grounded in interviews across organisations and explains many behaviours.

EX048. The budget is hard to measure directly and the paper offers a framework, not tested predictions.

EX049. As a lens for design, not a precise quantity.

EX050. In the programme charter, with citations.