Designing a Research Methodology for Secure IIoT Implementation in Indonesia: A Research Onion–Based Methodological Design
DOI:
https://doi.org/10.37278/sisinfo.v8i2.1574Keywords:
Research Onion, Industrial Internet of Things, Research Methodology, Research Design, Indonesia, IIoT SecurityAbstract
Selecting an appropriate methodological configuration is a persistent difficulty in applied cybersecurity research, where technical, regulatory, and organizational evidence must be reconciled within a single design. This paper presents a methodological design study: it derives, justifies, and operationalizes a complete research methodology for developing a secure Industrial Internet of Things (IIoT) framework in the Indonesian industrial context, using Saunders’ research onion as the organizing structure. Each of the six layers (philosophy, approach to theory development, methodological choice, strategy, time horizon, and techniques and procedures) is examined and a specific option selected, with justification grounded in the multi-source, multi-stakeholder character of IIoT security in Indonesia. The paper contributes three artifacts: a justified six-layer configuration (pragmatism, inductive, grounded theory, mixed-method, cross-sectional, interviews, focus group discussions, and systematic literature review); an operational protocol translating that configuration into research phases, informant categories, instruments, and analytical treatments; and an assessment of the methodological risks the configuration carries. The study reports a research design rather than empirical findings; data collection and framework validation are the subject of subsequent work, for which the paper sets out a staged agenda.
References
M. N. K. Saunders, P. Lewis, and A. Thornhill, Research Methods for Business Students, 9th ed. Harlow, United Kingdom: Pearson Education, 2023.
R. Alturki, “Research Onion for Smart IoT-Enabled Mobile Applications,” Scientific Programming, vol. 2021, p. 4270998, 2021, doi: 10.1155/2021/4270998.
Republic of Indonesia, “Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi).” Jakarta, Indonesia, Oct. 2022. [Online]. Available: https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022
M. R. Syailendra, G. Lie, and A. Sudiro, “Personal Data Protection Law in Indonesia: Challenges and Opportunities,” Indonesia Law Review, vol. 14, no. 2, p. 4, 2024, doi: 10.15742/ilrev.v14n2.4.
B. Alotaibi, “A Survey on Industrial Internet of Things Security: Requirements, Attacks, AI-Based Solutions, and Edge Computing Opportunities,” Sensors, vol. 23, no. 17, p. 7470, 2023, doi: 10.3390/s23177470.
S. Lou, Z. Hu, Y. Zhang, Y. Feng, M. Zhou, and C. Lv, “Human-Cyber-Physical System for Industry 5.0: A Review From a Human-Centric Perspective,” IEEE Transactions on Automation Science and Engineering, vol. 22, pp. 494–511, 2025, doi: 10.1109/TASE.2024.3360476.
M. Elgeddawy and M. Abouraia, “Pragmatism as a Research Paradigm,” in Proceedings of the 23rd European Conference on Research Methodology for Business and Management Studies (ECRM 2024), A. I. Azevedo, Ed., Reading, United Kingdom: Academic Conferences International, 2024, pp. 71–74.
C. Okoli, “Inductive, Abductive and Deductive Theorising,” International Journal of Management Concepts and Philosophy, vol. 16, no. 3, pp. 302–316, 2023, doi: 10.1504/IJMCP.2023.131769.
E. Bell, B. Harley, and A. Bryman, Business Research Methods, 6th ed. Oxford, United Kingdom: Oxford University Press, 2022.
B. G. Glaser and A. L. Strauss, The Discovery of Grounded Theory: Strategies for Qualitative Research. Chicago, Illinois, USA: Aldine, 1967.
V. B. Martin, C. Scott, B. Brennen, and M. G. Durham, “What Is Grounded Theory Good For?,” Journalism & Mass Communication Quarterly, vol. 95, no. 1, pp. 11–22, 2018, doi: 10.1177/1077699018759676.
M. Vollstedt and S. Rezat, “An Introduction to Grounded Theory with a Special Focus on Axial Coding and the Coding Paradigm,” in Compendium for Early Career Researchers in Mathematics Education, G. Kaiser and N. Presmeg, Eds., in ICME-13 Monographs. Cham, Switzerland: Springer, 2019, pp. 81–100. doi: 10.1007/978-3-030-15636-7_4.
J. W. Creswell and V. L. Plano Clark, Designing and Conducting Mixed Methods Research, 4th ed. Thousand Oaks, California, USA: SAGE Publications, 2025.
C. Maier, J. B. Thatcher, V. Grover, and Y. K. Dwivedi, “Cross-Sectional Research: A Critical Perspective, Use Cases, and Recommendations for IS Research,” International Journal of Information Management, vol. 70, p. 102625, 2023, doi: 10.1016/j.ijinfomgt.2023.102625.
C. Fung, E. Zeng, and L. Bauer, “Adopting AI to Protect Industrial Control Systems: Assessing Challenges and Opportunities from the Operators’ Perspective,” in Proceedings of the 21st Symposium on Usable Privacy and Security (SOUPS 2025), Seattle, Washington, USA, Aug. 2025, pp. 555–573. [Online]. Available: https://www.usenix.org/conference/soups2025/presentation/fung
J. M. Haney, J. L. Jacobs, F. Barrientos, and S. M. Furman, “Lessons Learned and Suitability of Focus Groups in Security Information Workers Research,” in HCI for Cybersecurity, Privacy and Trust (HCII 2022), A. Moallem, Ed., in Lecture Notes in Computer Science, vol. 13333. Cham, Switzerland: Springer, 2022, pp. 135–153. doi: 10.1007/978-3-031-05563-8_10.
M. J. Page et al., “The PRISMA 2020 Statement: An Updated Guideline for Reporting Systematic Reviews,” BMJ, vol. 372, p. n71, 2021, doi: 10.1136/bmj.n71.
Republic of Indonesia, “Government Regulation No. 71 of 2019 on the Administration of Electronic Systems and Transactions (Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik).” Jakarta, Indonesia, 2019. [Online]. Available: https://peraturan.bpk.go.id/Details/122030/pp-no-71-tahun-2019
National Institute of Standards and Technology, “The NIST Cybersecurity Framework (CSF) 2.0,” National Institute of Standards and Technology, Gaithersburg, Maryland, USA, NIST Cybersecurity White Paper (CSWP) 29, Feb. 2024. doi: 10.6028/NIST.CSWP.29.
International Electrotechnical Commission, “Industrial Communication Networks — Network and System Security — Part 3-3: System Security Requirements and Security Levels,” International Electrotechnical Commission, Geneva, Switzerland, IEC 62443-3-3:2013, Edition 1.0, 2013.
P. Radanliev et al., “Cyber Security Framework for the Internet-of-Things in Industry 4.0,” University Library of Munich, Munich, Germany, MPRA Paper No. 92565, 2019.
F. Brancati, D. Mongelli, F. Mariotti, and P. Lollini, “A Cybersecurity Risk Assessment Methodology for Industrial Automation Control Systems,” International Journal of Information Security, vol. 24, no. 2, p. 76, 2025, doi: 10.1007/s10207-025-00990-9.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Sidik Prabowo, Dadang Setiawan
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Authors who publish articles in SisInfo : Jurnal Sistem Informasi dan Informatika agree to the following terms:
- Authors retain copyright of the article and grant the journal right of first publication with the work simultaneously licensed under a CC-BY-SA or The Creative Commons Attribution-ShareAlike License.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgment of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).
