Cybersecurity Research: A Future Requirement for Mixed Method
Quantitative and Qualitative Research Designs can no longer stand on their own
Abstract
The author conducts a literature review on the topics of quantitative, qualitative, and mixed research design and how it will impact cybersecurity and data science. It identifies the differences and current historical debate between the two major branches: quantitative and qualitative. It attempts to posit a likely and expected path forward within the cybersecurity and data science communities. A common and modern theme within the selected literature is the need to move to the third and hybrid mixed methodology as a sound means to improve the future state of research. An example from quantum particle physics, a strong candidate for simple quantitative methods, highlights why the strengths and weaknesses of both historical approaches, quantitative and qualitative, may need to rely upon mixed as a sole solution. This article concludes with a suggested move to mixed as a standard for future academic study and research.
Keywords: hypothesis, mixed, pragmatic researchers, qualitative, quantitative, research design, research methods
Introduction
Baskarada and Koronios (2018) highlight that whether the fields are those of physics, the natural, or social sciences, they are all focused upon deterministic and mathematical outputs of results leaning toward the application of quantitative methods (Baskarada & Koronios, 2018). While the use of qualitative research has been well established within many scientific and humanistic fields of study, it has suffered from concerns about its subjectivity. There exists doubt about the value of qualitative research to include, for example, the medical field. It is “still regarded with skepticism by the medical community, accused of its subjective nature and absence of facts” (Malterud, 2001, p. 483). The debate regarding which research method to use appears to be leading the cybersecurity community in particular to a potential direction and requirement of the mixed methodology approach as a standard (Onwuegbuzie & Leech, 2005; Vogt, 2008). The solution will require a basic cross-application of quantitative and qualitative methods to ensure future rigorous and complete answers to study and research.
Quantitative research is focused on the numerical or statistical analyses to support or refute a specified hypothesis (Apuke, 2017). Zyphur and Pierides (2019) created the acronym of Statistics and Probability (S&P) to emphasize the power and logic of the quantitative methodology. The value of the quantitative relies on its ability to provide humans with a synopsis of large bodies of data in a standard language of mathematics and statistics; data science is already offering monumental leaps in the synthesis of Big Data repositories for better current and future predictions.
The quantitative design has had a more significant historical presence dating back to the late 19th Century (Creswell, J. W. & Creswell, J. D., 2018), and likely explains its preeminence. However, this has also fueled the ongoing debate and friction between the two primary forms of research design. In contrast, qualitative design approaches were not “clearly visible” until the 1990s (Creswell, J. W. & Creswell, J. D., 2018, p. 13). This later presence has contributed to the ongoing questionable acceptance by the more entrenched and parochial nature of the scientific community.
Qualitative methodologies will follow one or more of five main approaches to include: 1) narrative research, 2) phenomenology, 3) grounded theory, 4) ethnography or 5) case study (Creswell, J. W. & Creswell, J. D., 2018). This design approach may rely upon the interviewing of individuals who provide stories about their lives [narrative research], expanded study of groups of individuals experiencing the same situation or phenomenon [phenomenology], or a review of behavioral patterns or actions based upon anthropological and sociologic groupings [ethnography]. Qualitative design may also use surveys and open-ended questions in its application of these five approaches and provides the data for research; however, as identified by Vogt (2008), it may sometimes collect quantitative data such as the use of, for example, positive or negative adjectives in the conduct of the research such as good, better, or best (Vogt, 2008). Qualitative research may not only portend the use of the quantitative but may already be inherently embedded within the approach. Associated subjective qualitative data can be further synthesized to an understandable synopsis for the academic reader as similarly as the quantitative.
Mixed as the Future Standard for Cybersecurity Research Methodologies
The current literature appears to be advocating an overall move to the mixed methodology as a course of action for the academic community. Scholars have suggested that the “most effective approach is often pluralistic” (Vogt, 2008, p. 5). Onwuegbuzie and Leech (2005) advocate that graduate students be taught how to use and apply mixed research approaches in order to become, as they define, “pragmatic” researchers (Onwuegbuzie & Leech, 2005, p. 375)—this is also a move to address the divisive nature of the current debate between the quantitative and qualitative sides. Malterud (2001) also emphasizes the need for both methods when she espouses that the field of medical research needs “to prevent methodological separatism and supremacy if the field of medical knowledge is to be expanded…” (Malterud, 2001, p. 487). The demand from across the communities is seemingly supporting a truce that will result in an academic standard not yet realized.
Conclusion
While the purview of quantitative research methodologies in cybersecurity and data science have been assumed to be aligned with both the hard and soft sciences (Baskarada & Koronios, 2018), we can find the necessity to move to mixed from, for example, within the realm of quantum theoretical investigation. In 1998, the Weizmann Institute of Science (1998) reported: “that by the very act of watching, the observer affects the observed reality” in the observation of particle physics (Weizmann Institute of Science, 1998). In this example, this branch of science offers one reason that the purely quantified approach of numbers and statistics may not be enough for even one of the most demanding fields of study that typically relies heavily upon the quantitative. It will require a holistic research methodology that combines the strengths and weaknesses of each to create an effective research methodology that reduces or eliminates methodological biases. The mixed method appears to be the hybridized solution needed in the very near future.
References
Apuke, O. D. (2017). QUANTITATIVE RESEARCH METHODS A SYNOPSIS APPROACH. Kuwait Chapter of the Arabian Journal of Business and Management Review, 6(11), 40-47. doi:http://franklin.captechu.edu:2123/10.12816/0040336
Baskarada, S., & Koronios, A. (2018). A philosophical discussion of qualitative, quantitative, and mixed methods research in social science. Qualitative Research Journal, 18(1), 2-21. Retrieved from https://franklin.captechu.edu:2074/docview/1992640527?accountid=44888
Creswell, J. W., & Creswell, J. D. (2018). Research design: Qualitative, quantitative, and mixed methods approaches (5th ed.). Thousand Oaks, CA: Sage.
Malterud, K. (2001). Qualitative research: Standards, challenges, and guidelines. The Lancet, 358(9280), 483-488.
Onwuegbuzie, A. J., & Leech, N. L. (2005). On becoming a pragmatic researcher: The importance of combining quantitative and qualitative research methodologies. International journal of social research methodology, 8(5), 375-387.
Vogt, W. P. (2008). The dictatorship of the problem: Choosing research methods. Methodological Innovations Online, 3(1), 1-17.
Weizmann Institute of Science. (1998, February 27). Quantum theory demonstrated: Observation affects reality. Retrieved from
https://www.sciencedaily.com/releases/1998/02/980227055013.htm
Zyphur, M. J., & Pierides, D. C. (2019). Statistics and probability have always been value-laden: An historical ontology of quantitative research methods: JBE JBE. Journal of Business Ethics, 1-18. doi:http://franklin.captechu.edu:2123/10.1007/s10551-019-04187-8
Dr. Russo is currently the Senior Data Scientist with Cybersenetinel AI in Washington, DC. He is a former Senior Information Security Engineer within the Department of Defense’s (DOD) F-35 Joint Strike Fighter program. He has an extensive background in cybersecurity and is an expert in the Risk Management Framework (RMF) and DOD Instruction 8510, which implement RMF throughout the DOD and the federal government. He holds a Certified Information Systems Security Professional (CISSP) certification and a CISSP in information security architecture (ISSAP). He has a 2017 Chief Information Security Officer (CISO) certification from the National Defense University, Washington, DC. Dr. Russo retired from the US Army Reserves in 2012 as a Senior Intelligence Officer.
