Methodological foundations: enabling the next generation of security

The promise of breakthroughs in computer security - experimental test beds, insider-detection advancements, biometrics, and user interfaces that are robust to human error-will remain empty as long as methodological details trail the hype. A few selected issues - operational definitions, reliability, internal validity, and external validity - serve to illustrate common sources of experimental error that may be brought to one's attention by a written methodology. The first two issues regard valid measurement, and the second two regard valid experimentation. Together, they exemplify the importance of strong methodology in pushing the envelope of security.