Chapter 29 — Human factors and cyber policy: measurement

Lesson map

Lesson 29 published. Map, example, EX085.

flowchart TD
  N0["Learning outcomes"]
  N1["29.1 Outcome measures"]
  N2["29.2 Computing exposure"]
  N3["Lab — Time to first report and inbox exposure"]
  N4["29.3 Perverse incentives"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX085"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["29.1 Outcome measures"]
  N2["29.2 Computing exposure"]
  N3["Lab — Time to first report and inbox exposure"]
  N4["29.3 Perverse incentives"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX085"]

[Learning outcomes]
    |
    v
[29.1 Outcome measures]
    |
    v
[29.2 Computing exposure]
    |
    v
[Lab — Time to first report and inbox exposure]
    |
    v
[29.3 Perverse incentives]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX085]

Learning outcomes

You will (1) define outcome measures for the programme; (2) compute exposure time from report data; (3) avoid perverse incentives in metrics.

29.1 Outcome measures

Aiko defines measures for Greyford's programme: median time from arrival of a malicious email to first report; share of malicious emails reported by at least one person; share of reports that are genuine threats; staff burden from a quarterly two-question survey; and simulation click rate at fixed Phish Scale difficulty as a secondary measure. Each measure has a definition, a data source and an owner. She leads with reporting time because it relates directly to how long attacks remain active. Owners review their measures monthly with Aiko.

29.2 Computing exposure

The lab computes, for a month of synthetic malicious emails, the time to first report and the number of inboxes exposed until removal. Median time to first report is a few minutes, but two emails were never reported and were removed only when the filter vendor updated its rules hours later. Those two account for most of the exposure. Aiko recommends examining why they were not reported; both turn out to imitate an internal timesheet reminder that staff expected. She shares the finding with the filter vendor as well.

Lab — Time to first report and inbox exposure

# Time to first report and inbox-minutes of exposure for a month of malicious emails (synthetic).
emails = [("invoice lure", 40, 4, 30), ("mailbox full", 25, 6, 30), ("parcel", 60, 3, 25), ("ceo favour", 8, 11, 20),
          ("bank update", 35, 5, 30), ("timesheet reminder A", 120, None, 360), ("timesheet reminder B", 90, None, 300)]
# (name, recipients, minutes to first report or None, minutes to removal after report or after filter update)
total = 0; parts = []
for name, n, first, rem in emails:
    mins = (first + rem) if first is not None else rem
    exp = n * mins; total += exp; parts.append((name, first, exp))
firsts = sorted(f for _, f, _ in parts if f is not None)
print(f"median time to first report (reported emails): {firsts[len(firsts) // 2]} min; never reported: {sum(f is None for _, f, _ in parts)}")
unrep = sum(e for _, f, e in parts if f is None)
print(f"total inbox-minutes {total}; never-reported share {unrep / total:.0%}")

Run with python3 lab_exposure.py. Verified output:

median time to first report (reported emails): 5 min; never reported: 2
total inbox-minutes 75613; never-reported share 93%

29.3 Perverse incentives

Aiko warns against targets that distort behaviour. A target to reduce click rates could be met by sending easier simulations less often. A target for report numbers could be met by encouraging staff to report everything, overloading triage. She proposes watching measures in pairs, such as report numbers alongside the share of genuine threats, and never tying individual pay or discipline to them. Measurement should help the programme learn, not create games. She writes these rules into the programme charter so that future managers cannot quietly introduce individual targets, and she asks the board to review the measures each year to check they still serve learning.

Worked example

Aiko defines five measures with owners, computes reporting time and exposure from synthetic data, and pairs measures to avoid perverse incentives.

Synthetic case. Data are synthetic; the Phish Scale is real.

Errors and limits

Unreported emails are only found if detected another way. Paired measures still need judgement.

Exercises

• EX085 — Lead measure. Why lead with reporting time?
  Show marking criteria

  Rubric: 3 = it relates directly to how long attacks stay active;; 2 = exposure;; 1 = vague;; 0 = none.
• EX086 — Lab exposure. How much exposure came from the two unreported emails?
  Show marking criteria

  Rubric: 3 = two never-reported emails caused 93% of inbox-minutes exposure;; 2 = most exposure;; 1 = vague;; 0 = none.
• EX087 — Paired measures. Why watch measures in pairs?
  Show marking criteria

  Rubric: 3 = to stop one target being gamed at another's expense;; 2 = gaming;; 1 = vague;; 0 = none.

Synthesis

Measures centred on exposure, watched in pairs and kept away from individual consequences help a programme learn.

Continue studying — chapter 29 of 50

← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →