OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Why numbers matter in a SOC"]
N2["1.2 The course case"]
N3["1.3 Counts versus rates"]
N4["Lab — rates per group"]
N5["1.4 Reading the result"]
N6["1.5 Misleading numbers"]
N7["1.6 Showing your working"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Why numbers matter in a SOC"]
N2["1.2 The course case"]
N3["1.3 Counts versus rates"]
N4["Lab — rates per group"]
N5["1.4 Reading the result"]
N6["1.5 Misleading numbers"]
N7["1.6 Showing your working"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Why numbers matter in a SOC]
|
v
[1.2 The course case]
|
v
[1.3 Counts versus rates]
|
v
[Lab — rates per group]
|
v
[1.4 Reading the result]
|
v
[1.5 Misleading numbers]
|
v
[1.6 Showing your working]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) use ratios, rates and percentages correctly in security reporting; (2) compare groups of different sizes fairly; (3) recognise misleading numbers; (4) state calculations so others can check them.
1.1 Why numbers matter in a SOC
Security teams report numbers constantly: how many phishing emails were reported, how many people clicked, how many accounts were compromised. Decisions about training, filtering and staffing follow from these numbers, so they must be computed and explained correctly.
In the library-fines campaign, Dr. Kim had to decide whether to spend her small training budget on students or staff. A raw count of reports pointed one way and a rate pointed the other, so the choice depended on Lucas computing the right figure and explaining it in a sentence she could repeat to the university's leadership.
1.2 The course case
Lucas Moreau studies for a bachelor's degree at the fictional Riverton University and works part-time in its student-staffed campus security operations centre, supervised by the university's information security manager Dr. Hana Kim. In week three of term, a phishing email titled "Library fines overdue" reaches thousands of students and staff.
The campaign runs through the whole book. Early chapters use it to practise counting, programming and writing; later ones follow the same incident through detection, containment and review. Every person, account and figure in it is synthetic, so students can examine it freely without touching anyone's real mail or sign-in records.
1.3 Counts versus rates
Students reported 54 emails and staff 41. Raw counts suggest students were more alert, but there are 18,000 students and only 3,200 staff. Rates per 1,000 people make groups of different sizes comparable.
Here that gives 54 ÷ 18,000 × 1,000 for students and 41 ÷ 3,200 × 1,000 for staff. Lucas also checks that both groups received the email at all, since a rate based on the whole population would mislead if the campaign had reached only some faculties. The denominator should be the people who could have reported, which here was everyone, since the email went to the whole university.
Lab — rates per group
"""Rates and percentages for Riverton campus phishing reports (synthetic)."""
users = {"students": 18000, "staff": 3200}
reported = {"students": 54, "staff": 41}
clicked = {"students": 27, "staff": 6}
for g in users:
print(f"{g:8} report rate={1000*reported[g]/users[g]:.1f} per 1,000 click rate={1000*clicked[g]/users[g]:.1f} per 1,000 clicks per report={clicked[g]/reported[g]:.2f}")
Run with python3 lab_rates.py. Verified output:
students report rate=3.0 per 1,000 click rate=1.5 per 1,000 clicks per report=0.50
staff report rate=12.8 per 1,000 click rate=1.9 per 1,000 clicks per report=0.15
1.4 Reading the result
Staff reported at 12.8 per 1,000, more than four times the student rate of 3.0. Click rates were similar (1.9 per 1,000 for staff and 1.5 for students), but for every staff report there were only 0.15 clicks, against 0.50 for students. Students clicked about as often but reported much less.
Those ratios come from 27 student clicks against 54 student reports, and 6 staff clicks against 41 staff reports. Together the 33 clickers match the set of clicking accounts analysed in later chapters. Lucas's conclusion for Dr. Kim was that training should encourage students to report, since they already click no more often than staff.
1.5 Misleading numbers
Percentages of tiny groups, missing denominators and changing definitions mislead. Always state what was counted, out of how many, over what period.
A department of eight people where two clicked has a 25% click rate, which sounds alarming next to the campus figure but rests on two people. Lucas reports such cases as counts with the group size beside them. If the definition of a "report" changes, for example to include phone calls, he marks the change so trends are not misread.
1.6 Showing your working
Lucas writes the formula beside each figure — reports ÷ users × 1,000 — so Dr. Kim can check it in seconds.
Writing the formula also exposes mistakes. In his first draft Lucas divided staff reports by the student population, which produced an implausibly small rate; seeing the formula beside the figure, Dr. Kim spotted it at once. A number with its working can be checked and corrected, while a bare number has to be trusted. Lucas now keeps the formula in the report itself, not only in his notes.
Worked example
Lucas drafts: "Students reported more phishing than staff (54 vs 41)." Dr. Kim asks him to rewrite with rates. His revision: "Staff reported phishing at 12.8 per 1,000 people versus 3.0 for students; click rates were similar, so student reporting is the gap to address."
Synthetic case. Riverton University, its SOC and all people are invented; figures come from the lab script.
Errors and limits
Rates from small groups jump around; a department of 20 people with one click has a rate of 50 per 1,000, which says little.
Exercises
- EX001 — Fair comparison. Why compare rates per 1,000 rather than raw counts?
Show marking criteria
Rubric: 3 = groups differ in size; rates make them comparable; 2 = partial; 1 = counts fine; 0 = none. - EX002 — Lab rates. Give report and click rates for both groups.
Show marking criteria
Rubric: 3 = students 3.0 and 1.5; staff 12.8 and 1.9 per 1,000; 2 = two; 1 = one; 0 = none. - EX003 — The real gap. What does the clicks-per-report ratio reveal?
Show marking criteria
Rubric: 3 = students click about as much but report far less (0.50 vs 0.15); 2 = partial; 1 = vague; 0 = none.
Synthesis
Use rates with clear denominators, show working and question numbers that compare unequal groups.