OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Ratios and rates"]
N2["1.2 Base rates"]
N3["1.3 Checking claims"]
N4["Lab — Base rates and false warnings"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Ratios and rates"]
N2["1.2 Base rates"]
N3["1.3 Checking claims"]
N4["Lab — Base rates and false warnings"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Ratios and rates]
|
v
[1.2 Base rates]
|
v
[1.3 Checking claims]
|
v
[Lab — Base rates and false warnings]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) use ratios and percentages to describe security behaviour; (2) reason about base rates when judging alerts; (3) check claims with simple arithmetic.
1.1 Ratios and rates
Nadia Farouk, a first-year student at the fictional Fenmoor University, begins her course by studying a library network. The fictional Ashcombe Community Library Network has 120 staff across nine branches. Last year staff reported 48 suspicious emails, and 12 of them were genuinely malicious. A ratio compares two counts, and a rate expresses one count per unit, such as reports per hundred staff. Nadia computes 48 reports for 120 staff, or 40 per hundred staff, and 12 of 48, or one quarter, as the share of reports that were real threats.
1.2 Base rates
Her supervisor, Dr Owen Prescott, asks Nadia to think about base rates. If one email in a thousand is malicious and a warning banner flags 5% of all emails, most flagged emails will be harmless, because harmless emails vastly outnumber malicious ones. People who see many false warnings learn to ignore them, a pattern Herley (2009) described when he argued that users rationally ignore advice whose costs exceed its benefits. Understanding base rates helps Nadia see why staff behaviour that looks careless can be a sensible response to noisy signals.
1.3 Checking claims
Nadia reads a vendor brochure claiming that training reduces phishing risk by 70%. She asks: 70% of what, measured how, and compared with what? A drop in clicks on easy simulated emails does not mean a drop in real losses. She checks the arithmetic of another claim, that reports rose from 20 to 48, and finds it is a 140% increase, not the 240% stated. Simple arithmetic and careful questions protect against misleading figures, which are common in security marketing and even in internal reports. She keeps a checklist of these questions.
Lab — Base rates and false warnings
# Base rates and false warnings (synthetic): 100,000 emails, 1 in 1,000 malicious.
n = 100_000; mal = n // 1000; ben = n - mal
flag_mal = int(mal * 0.90) # banner catches 90% of malicious
flag_ben = int(ben * 0.05) # and flags 5% of harmless
flagged = flag_mal + flag_ben
print(f"flagged {flagged}: malicious {flag_mal}, harmless {flag_ben} ({flag_ben / flagged:.0%} harmless)")
Run with python3 lab_base.py. Verified output:
flagged 5085: malicious 90, harmless 4995 (98% harmless)
Worked example
Nadia computes report rates, uses base rates to explain ignored warnings and checks claimed percentages.
Synthetic case. The library network is synthetic; Herley (2009) is real.
Errors and limits
Percentages hide small counts. Base rates change over time.
Exercises
- EX001 — Reports per hundred. How many reports per hundred staff did Ashcombe receive?
Show marking criteria
Rubric: 3 = 40;; 2 = 48 per 120;; 1 = 48;; 0 = none. - EX002 — Flagged harmless share. In the lab, what share of flagged emails were harmless?
Show marking criteria
Rubric: 3 = about 98%;; 2 = most;; 1 = 5%;; 0 = none. - EX003 — Increase check. What is the true increase from 20 to 48 reports?
Show marking criteria
Rubric: 3 = 140%;; 2 = 28 more;; 1 = 240%;; 0 = none.
Synthesis
Ratios, base rates and checked arithmetic are the first tools for reasoning about security behaviour.