Chapter 10 — Research reading and critique
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Reading critically"]
N2["10.2 Evidence quality"]
N3["10.3 Connecting to practice"]
N4["10.4 Writing a critique"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Reading critically"]
N2["10.2 Evidence quality"]
N3["10.3 Connecting to practice"]
N4["10.4 Writing a critique"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Reading critically]
|
v
[10.2 Evidence quality]
|
v
[10.3 Connecting to practice]
|
v
[10.4 Writing a critique]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) read research on access control and authentication critically; (2) assess evidence quality; (3) connect findings to practice.
10.1 Reading critically
Marta reads published research to inform her work and to place it in context. She reads Sandhu and colleagues (1996) on role-based access control, Bonneau and colleagues (2012) on comparing authentication schemes and Herley (2009) on why users reject security advice. For each, she asks what question was studied, what method was used, what evidence supports the conclusions and how far they apply to Corran. Reading critically means neither accepting conclusions because they are published nor dismissing them because the setting differs.
Herley's argument concerns ordinary users weighing security advice, so Marta asks whether it fits Corran's administrators, who face different incentives.
10.2 Evidence quality
Evidence varies in strength. A formal model, like the role-based access control family, shows what is logically possible but not how organisations behave. A comparative framework, like Bonneau and colleagues', structures judgement but depends on the evaluators' ratings. A large measurement study, like Florêncio and Herley (2007) on password habits, shows real behaviour at scale but in a consumer setting. Marta notes the kind of evidence each provides, so she uses each for what it can support and no more.
10.3 Connecting to practice
Herley's argument that people rationally reject costly security advice helps explain why Corran's administrators had resisted earlier controls that added friction without visible benefit. Design B's fast, automatic elevation reduced friction, which may explain its smoother adoption. Bonneau and colleagues' framework helped Marta compare authenticators for administrators systematically. Connecting research to practice in this way strengthens her recommendations, while she remains careful not to claim that published findings prove what happened at Corran. She marks these links as interpretations, not findings, and invites readers to weigh them against Corran's own evidence.
10.4 Writing a critique
Marta writes a short critique of one paper for her course, summarising its question, method and findings, then assessing strengths, limitations and relevance. She avoids attacking the authors and focuses on what the evidence can and cannot show. She also notes what further research would help, such as studies of privileged access practices in small and medium organisations, where published evidence is thin. Good critique advances understanding by being fair, specific and constructive. Her lecturer's feedback praises the balance and suggests one further limitation about sampling.
Worked example
Marta's critique of a password-habits study praises its scale, notes its consumer setting and suggests workplace studies of administrators as further research.
Synthetic case. Marta's critique is synthetic; the cited papers are real.
Errors and limits
Treating a formal model as evidence of how organisations behave confuses logical possibility with observed practice.
Exercises
- EX046 — Critical questions. What four questions does Marta ask of each paper? Rubric: 3 = question, method, evidence, applicability;; 2 = three;; 1 = one;; 0 = none.
- EX047 — Model limitation. What can a formal model not show? Rubric: 3 = how organisations actually behave;; 2 = behaviour;; 1 = logic;; 0 = none.
- EX048 — Herley relevance. How does Herley's argument help explain Corran? Rubric: 3 = admins resisted costly controls without visible benefit;; 2 = friction;; 1 = vague;; 0 = none.
- EX049 — Research gap. What further research does Marta suggest? Rubric: 3 = privileged access practices in small and medium organisations;; 2 = SMEs;; 1 = vague;; 0 = none.
- EX050 — Critique tone. What should a good critique focus on? Rubric: 3 = what evidence can and cannot show, fairly and constructively;; 2 = evidence;; 1 = authors;; 0 = none.
Synthesis
Critical reading matches each kind of evidence to what it can support and connects research to practice carefully.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →