The Scientific Method in Security Research

The Research Problem in Security

Security research is frequently criticized for lacking process and adherence to traditional research methods. Much so-called research consists of tearing apart systems and exposing vulnerabilities—useful but lacking scientific rigor.

Scientific Method in Practice

The speaker demonstrates how rigorous scientific methodology can be applied to security research through his own work on insulin pump security, which led to widely-cited 2011 findings about medical device vulnerabilities.

Structured Hypothesis and Testing

Applying the scientific method means forming testable hypotheses, designing controlled experiments, documenting methodology, and drawing conclusions supported by evidence. This approach produces research that is reproducible and defensible.

Increasing Credibility and Impact

Security researchers who follow scientific methodology gain credibility with academic institutions, journalists, policymakers, and the media. The speaker argues that relatively small changes to how security research is conducted can bring greater outside credibility to important security work.