Chapter 1 — Mathematical reasoning | Bachelor's Critical infrastructure and sector security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 01 published. Map, example, EX002.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["1.1 Why security needs numbers — and why numbers are"]
  N2["1.3 Orders of magnitude and bounding"]
  N3["1.5 Practical activity: Lab 1"]
  N4["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX002"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["1.1 Why security needs numbers — and why numbers are"]
  N2["1.3 Orders of magnitude and bounding"]
  N3["1.5 Practical activity: Lab 1"]
  N4["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX002"]

[Learning outcomes and connection]
    |
    v
[1.1 Why security needs numbers — and why numbers are]
    |
    v
[1.3 Orders of magnitude and bounding]
    |
    v
[1.5 Practical activity: Lab 1]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX002]

Learning outcomes and connection

After this chapter you can (1) turn a vague worry ("what if the dispatch centre loses its internet link?") into a quantity with units; (2) compute an expected annual loss and explain why it is not the same as the worst credible event; (3) estimate orders of magnitude and check a calculation by bounding it; and (4) state the assumptions behind a number so that someone else can disagree with them precisely. The chapter introduces the synthetic Calder County used throughout the book and prepares Chapter 6 (discrete structures) and Chapter 12 (probability and statistics).

1.1 Why security needs numbers — and why numbers are not enough

Critical-sector security is full of comparisons. Should Calder Valley Hospital spend money on a second network link or on testing its generators? Should Calder Power Networks patch a feeder controller now, during a planned outage next month, or never? These are decisions under uncertainty, and the only honest way to compare them is to make the uncertainty explicit. Mathematical reasoning here does not mean advanced mathematics. It means four habits: give every quantity a unit; write down where every number came from; check a result by estimating it another way; and say what would change the answer.

A quantity is a number with a unit: 4 hours, £2,000 per hour, 0.3 events per year. Most errors in risk arithmetic are unit errors: multiplying a probability per year by a cost per hour, or adding a percentage to a count. Writing units next to every term — and cancelling them as you go — catches these errors before anyone else does.

1.2 Expected value and its limits

For a one-event annual model, if an event has probability $p$ and costs $C$ when it happens, its expected annual loss (EAL) is $p \times C$. Expected losses for distinct cost components add even when the events are dependent: this is the linearity of expectation. The analyst must still avoid counting the same consequence twice when scenarios overlap. Independence is needed for some probability calculations, such as multiplying the probabilities of two failures, but not for adding expected costs. Expected value helps compare a control's yearly cost with the loss it might avoid. It can also hide important differences: a 1-in-100 catastrophe and a near-certain nuisance may have the same product. For a hospital, a 72-hour loss of power is not "the same" as seventy-two one-hour losses: patients who need ventilation, dialysis or surgery are harmed by duration, not by an average. So every expected-value table in this book is paired with a worst credible event — the most severe outcome you believe could realistically occur, stated with its duration.

Probabilities used in such tables are rarely measured. They are estimates from incident records, sector reports or expert judgement. That is acceptable only if you say so. A good habit is to write the source in brackets — "(estimate, CEDC operations manager, 2026)" — and to try the calculation with half and double the estimate. If the decision does not change, the estimate is good enough; if it does, it needs more evidence. Chapter 15 returns to this idea as sensitivity analysis.

1.3 Orders of magnitude and bounding

Before calculating precisely, estimate. A hospital with 420 beds might lose on the order of thousands of pounds per hour of disruption in cancelled procedures and diverted ambulances, not tens or millions. An estimate that lands three orders of magnitude away from the careful calculation is a sign that a unit or a decimal point has slipped. Bounding is the related skill: if you cannot estimate a quantity, find numbers it must lie between. If a generator test programme costs at least £8,000 (staff time) and at most £15,000 (staff time plus fuel and contractor), a decision that holds at both ends does not need the exact figure.

1.4 Worked example: two proposals in Calder County (synthetic)

This case is synthetic. Calder County's County Resilience Partnership (CRP) has money for one of two proposals.

A — second internet link for the County Emergency Dispatch Centre (CEDC), cost £18,000 a year. Without it, CRP estimates a 0.30 annual chance of a 4-hour link outage and a 0.02 chance of a 48-hour outage (a cut cable on the single route), each costing £2,000 per hour in fallback staffing and delay.
B — a generator test programme for Calder Valley Hospital, cost £12,000 a year. Without it, the estimate is a 0.10 chance of a 12-hour failure to start during a grid outage and a 0.01 chance of a 72-hour failure, each costing £5,000 per hour.

For A, EAL = 0.30 × 4 h × £2,000/h + 0.02 × 48 h × £2,000/h = £2,400 + £1,920 = £4,320 a year. For B, EAL = 0.10 × 12 × 5,000 + 0.01 × 72 × 5,000 = £6,000 + £3,600 = £9,600. Neither option "pays for itself" in expected terms (ratios 0.24 and 0.80), which is common for resilience spending: we buy protection against tails, not averages. The worst credible events (£96,000 and £360,000) make B the stronger case — and B's harm is to patients, which no pound figure fully expresses. The recommendation is B, with the stated assumption that the probability estimates are within a factor of two.

1.5 Practical activity: Lab 1

The lab reproduces the comparison. Change one probability at a time by a factor of two and see whether the ranking changes.

# Lab 1 - expected loss versus worst credible case for two options (synthetic Calder data, offline)
options = {
    "A: second ISP link for dispatch centre": {"cost": 18_000, "scenarios": [(0.30, 4, 2_000), (0.02, 48, 2_000)]},
    "B: backup generator test programme":     {"cost": 12_000, "scenarios": [(0.10, 12, 5_000), (0.01, 72, 5_000)]},
}
# each scenario: (annual probability it occurs without the option, outage hours, loss per hour in GBP)
for name, o in options.items():
    eal = sum(p * h * c for p, h, c in o["scenarios"])
    worst = max(h * c for p, h, c in o["scenarios"])
    print(f"{name}: expected annual loss avoided = {eal:,.0f}; worst single event = {worst:,.0f}; cost = {o['cost']:,}")
    print(f"   ratio avoided/cost = {eal / o['cost']:.2f}")

Expected output:

A: second ISP link for dispatch centre: expected annual loss avoided = 4,320; worst single event = 96,000; cost = 18,000
   ratio avoided/cost = 0.24
B: backup generator test programme: expected annual loss avoided = 9,600; worst single event = 360,000; cost = 12,000
   ratio avoided/cost = 0.80

The lab assumes each option removes its scenarios completely. Real controls reduce probability or duration partially; Exercise EX002 asks you to model that.

Two runs show what the lab is for. Halving B's 0.10 probability to 0.05 lowers its expected loss to £6,600, still above A's £4,320, so the ranking holds. Doubling A's 0.02 chance of a 48-hour outage to 0.04 raises A to £6,240, still below B. Because neither single change flips the order, the recommendation for the generator programme is robust to a factor of two in any one estimate, which is exactly the claim the worked example made.

1.6 Common errors and limits

Multiplying quantities with incompatible units (per-year by per-hour without converting).
Presenting an estimated probability as if it were measured.
Ranking options by expected loss alone when harm to people depends on duration.
Forgetting that controls rarely remove a risk entirely.
Adding probabilities of events that are not mutually exclusive (Chapter 12 shows the correct rule).

Each error has a Calder example. The EX001 colleague multiplied a per-year probability by hours and called the result pounds per hour. Writing "0.02 chance" with no source makes CEDC's guess look like a measured rate. Ranking A and B by expected loss alone would hide that B's £360,000 tail is 72 hours without reliable hospital power. And the lab's own assumption, that each option removes its scenarios entirely, is the fourth error built into a teaching model on purpose.

Exercises — chapter 1

EX001 — Unit discipline. Objective: find and fix unit errors. Inputs: a colleague writes "EAL = 0.02 per year × 48 hours × £2,000 = £1,920 per hour". Steps: (1) cancel the units term by term; (2) state the correct unit of the result; (3) explain in one sentence why the mistake matters for comparing with a £18,000 annual cost. Expected evidence: corrected expression with units. Rubric: 3 = correct unit (£ per year) and a clear reason; 2 = correct unit, weak reason; 1 = notices an error but misstates it; 0 = none.

EX002 — Partial effectiveness. Objective: model a control that only reduces a risk. Inputs: Lab 1. Steps: suppose option B halves the probability of each scenario rather than removing it; modify the lab to compute the loss avoided; then double both of B's probabilities and recompute. Expected evidence: two numbers and a two-sentence recommendation. Rubric: 3 = correct values (£4,800 and £9,600) and a recommendation that mentions worst credible events; 2 = numbers right, weak argument; 1 = one number; 0 = none.

Chapter synthesis

Security decisions are comparisons under uncertainty. Give quantities units, separate expected loss from worst credible harm, check results by estimation and bounding, and say which assumptions would change the decision. A number with no stated source or sensitivity is an opinion in disguise.