Studying IT Security Professionals: Research Design and Lessons Learned

The HOT Admin Field Study used qualitative methods to study information technology security administrators. Both the nature of the field and the difficulty of gaining access to subjects had implications for the study design. We present the lessons we learned, and offer some suggestions for future similar research.