Security Design: Why It’s Hard To Do Empirical Research

I am frustrated and disappointed at the number of weakly validated software engineering research results. I have found none that specifically address my research problems and only a few examples that generally apply. In particular, I have looked for accepted research techniques that can be used with relatively few data points and research methods that address variability issues across organizations. I believe that software engineering researchers are hindered because of limited access to industrial data, system complexity and variability, and inexperience with qualitative research methods. My research validation also suffers from these factors. Social scientists and design researchers share some of these problems but have established validations techniques to deal with them. Although software engineering researchers face some unique challenges, I am hopeful that research methods from other disciplines can improve validation of my results.