Pattern, Practice, and Potency of Information Systems Security Research: A Methodological Perspective

Discussion – Potency of ISsec Research 144 Collectively, by approaching information systems security issues from different perspectives and with diverse focuses, these four research tracks can examine security phenomena in a coherent and holistic manner. Beginning with abstract theoretical and practical research architectures, attention is drawn to the concrete factors and processes influencing security before proceeding to examine the short-term impact of economic and behavioural factors. Finally, they consider structural and strategic factors to suggest long-term security-improvement targets. Therefore, the four tracks are closely interconnected and mutually informative. Jointly, they describe the entire security research process, from abstract level to concrete level, clearly and specifically. Moreover, they offer a coherent picture of the overall security management process from immediate concerns to future challenges. Consequently, they weave a complete research roadmap that offers numerous promising research areas. However, research in this area has been limited in terms of its methodological choices. Typically, it follows IS research in adopting the four components of research paradigm, research theory, research method and research analysis. While there is no single overarching methodological underpinning, it exhibits a largely uniform approach to these four components. This study draws on the reticulated model of science and MT to offer numerous suggestions for improvement. All four research tracks are advised to become more diverse and inclusive by expanding current practice to include the three main research paradigms, four research theories, a wider range of research methods and three levels of research analysis (Table 10-1). Discussion – Potency of ISsec Research 145 It might be argued that expanding the range of research components in each track may invalidate the research pattern identified here; in other words, the current differentiation of ISsec research into four clusters may no longer work if all four tracks adopt a similar combination of research components (especially in the case of ISsec economic research, ISsec behavioural research and ISsec strategic research). However, the researcher would counter this by arguing that in each track, the pattern of methodological components has its origins in the ultimate purpose of the track; it is determined by the nature of the track rather than the researcher’s preferences. Since there are fundamental differences between the tracks, these methodological patterns will never disappear (though they are likely to be less obvious than they are now) even if researchers employ a wider range of research tools. Discussion – Potency of ISsec Research 146 Table 10-1 Summary of Recommended Practices for Research Components in ISsec Research Research Component Recommended Practice Research Track(s) Applied Research Paradigm Positivist ISsec Design Interpretive ISsec Economic, ISsec Behavioural, and ISsec Stragetic Critical Research Theory Theory for analysing ISsec Economic, ISsec Behavioural, and ISsec Stragetic Theory for explaining Theory for predicting Theory for explaining and predicting Theory for design and action ISsec Design Research Method Explanation/Behavioural method (Both qualitative and quantitative approaches) ISsec Economic, ISsec Behavioural, and ISsec Stragetic Improvement method ISsec Design Research Analysis Individual level ISsec economic, ISsec behavioural, ISsec stragetic, and ISsec Design Organisational level