Chapter 7 — Statistics for security work

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Counts and proportions"]
  N2["7.2 Averages and spread"]
  N3["7.3 Comparing groups"]
  N4["7.4 Uncertainty"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Counts and proportions"]
  N2["7.2 Averages and spread"]
  N3["7.3 Comparing groups"]
  N4["7.4 Uncertainty"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Counts and proportions]
    |
    v
[7.2 Averages and spread]
    |
    v
[7.3 Comparing groups]
    |
    v
[7.4 Uncertainty]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) summarise security data with simple statistics; (2) interpret proportions and averages; (3) recognise misleading comparisons.

7.1 Counts and proportions

Aisha learns that many security measures are counts and proportions: the number of unpatched computers, the share of staff completing training, the proportion of phishing tests reported. She computes that 112 of 140 synthetic staff completed annual training, eighty percent. Dr. Carrow asks her to always report the denominator, because a count of 112 means little without knowing it is out of 140. She also reports the twenty-eight staff who had not completed it, listed by branch, so managers can follow up. Dr. Carrow notes that the same figure can be presented as completion or as a gap, and both views are useful.

7.2 Averages and spread

Aisha calculates how long Ashfield takes to close security findings. The mean is twenty-six days, but a few findings took over a hundred days. The median is fifteen days. She learns that the mean is pulled up by extreme values, so the median often describes a typical case better. She reports both, plus the longest cases, because those long-running findings may represent the greatest risk. She draws a simple chart of closure times, which shows most findings closing within a month and a long tail of slow ones.

7.3 Comparing groups

Ashfield's managers want to know which branch is most secure. Aisha notes that the largest branch has the most incidents but also the most staff and transactions. Comparing raw counts would unfairly blame it. She calculates incidents per hundred staff, which changes the ranking. Dr. Carrow explains that rates allow fair comparison between groups of different sizes. With rates, the largest branch moves from worst to second best, and the smallest branch, which had few incidents in total, turns out to have the highest rate. Ashfield's managers are surprised and ask her to repeat the analysis each quarter.

7.4 Uncertainty

With small numbers, differences can arise by chance. One branch had three phishing reports last month and seven this month. Aisha explains that this change may not mean anything, because counts this small vary naturally. She suggests looking at several months before drawing conclusions. She learns that security reports should avoid treating normal variation as meaningful change. She shows the managers twelve months of reports per branch in one chart, where the month-to-month ups and downs are clearly visible. The managers agree to review trends quarterly rather than reacting to single months, which reduces unnecessary worry.

Worked example

Aisha reports training completion with its denominator, compares mean and median closure times, uses rates to compare branches and warns about chance variation.

Synthetic case. Figures are synthetic.

Errors and limits

Comparing raw counts between groups of different sizes misleads.

Exercises

• EX019 — Training rate. What share of staff completed training?
  Show marking criteria

  Rubric: 3 = 112 of 140, eighty percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX020 — Median closure. What is the median closure time?
  Show marking criteria

  Rubric: 3 = fifteen days;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX021 — Fair comparison. How are branches compared fairly?
  Show marking criteria

  Rubric: 3 = incidents per hundred staff;; 2 = partly correct;; 1 = raw;; 0 = none.