# Research Methodologies in Information Security
Research: The Road Ahead

Johan F. Niekerk, Rossouw Solms

► To cite this version:

Johan F. Niekerk, Rossouw Solms. Research Methodologies in Information Security Research: The Road Ahead. 25th IFIP TC 11 International Information Security Conference (SEC) / Held as Part of World Computer Congress (WCC), Sep 2010, Brisbane, Australia. pp.215-216, 10.1007/978-3-642-15257-3_19. hal-01054516

HAL Id: hal-01054516

https://inria.hal.science/hal-01054516

Submitted on 7 Aug 2014

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Research Methodologies in Information Security
## Research: The Road Ahead

J.F. van Niekerk, R. von Solms

Institute for Information and Communication Technology Advancement, Nelson
Mandela Metropolitan University

**Abstract.** This panel discussion will examine the *methodological traditions* currently existing amongst the fraternity of information security researchers. Information security researchers commonly engage in research activities ranging from the highly technical, to the "softer" human orientated. As such, researchers engaged in the field of information security could potentially make use of research philosophies, paradigms, and methodologies ranging from the quantitative/positivist to the interpretive/qualitative. This panel discussion will examine current trends in the selection and use of research methodologies amongst researchers from the information security fraternity and will attempt to address issues relating to such choices. Finally the possible impact of methodological *traditions* from the human and social sciences on future information security research activities will be discussed.

# 1 Introduction

The field of *information security* encompasses a wide range of interests and activities. As such, research activities in *information security* could include elements ranging from technical fields, such as engineering, mathematics, or application development, to fields that are normally classified as forming part of the human and social sciences, such as, management, law, psychology, or education. Therefore, unlike many other fields of study, information security has no single specific methodological tradition that is commonly accepted by the entire fraternity of information security researchers. This wide range of methodological choices available to information security researchers could potentially have an impact on how "usable" the results of any specific information security publication is to other information security researchers.

Research methodologies play a very important role in ensuring both the quality of research and in determining whether or not the results of one study could be meaningfully integrated with the results of another. Without a clear and rigorous methodology it becomes difficult for the reader to assess the validity and trustworthiness of the publication's research results. The methodology itself does not necessarily validate the research, it does however convey to the reader how formalisms apply to the published work. As stated by Marcus and Lee [1], "Methodologies in themselves, like algebraic symbols, are formalisms, devoid of empirical content. Shared examples of the empirical application of methods are
essential for establishing how the formalisms (whether intensive or extensive, positivist or interpretive) apply”.

All researchers are to varying degrees dependent on the work done by other researchers before them. Sir Isaac Newton, one of the foremost scientists of the last few centuries, is often quoted as having said: "If I have seen further it is only by standing on the shoulders of giants". This is true of most research. A researcher's work is often judged by the credibility of his/her argument, which is based on a *specific* philosophical stance and which is supported by the arguments of earlier researchers (included as citations in his/her work). Even the best research results might be discredited if it was based on prior research of doubtful integrity, or if it was based on prior work from an incompatible philosophical stance.

Due to the wide range of possible philosophical stances, paradigms, or research methodologies that could be chosen by information security researchers, it could be argued that *issues relating to the compatibility of prior research are even more important in information security studies than in other "more unified" fields*. It is therefor imperative, in order to ensure the continued trustworthiness of published information security research, for the information security research fraternity to engage in reflexive discussion regarding the methodological traditions in the field of information security.

This panel discussion will examine issues relating to current trends in the selection and usage of research methodologies amongst information security researchers and the possible impact of such trends on future information security research. The purpose of this panel discussion is to encourage healthy debate regarding the current and future use of various methodological traditions amongst the information security research fraternity. The panel will specifically focus on the "borrowing" of qualitative methods for use in information security research. There have been calls in the past for information security researchers to pay more attention to theories from the human and social sciences when dealing with the human aspects of information security. Should information security researchers who "adopts" qualitative methodologies from the human and social sciences also adhere to the *traditions* ensuring research rigor amongst researchers in the human or social sciences? Or will the information security research fraternity eventually "evolve" its own methodological *traditions* relating to the use of these "borrowed" methodologies?

## References

1. Marcus, M.L., Lee, A.S.: Special issue on intensive research in information systems: Using qualitative, interpretive, and case methods to study information technology: Foreward. MIS Quarterly **23**(1) (March 1999) 35–38