Chapter 41 — Human factors and cyber policy: system optimization
Lesson map
Lesson 41 published. Map, example, EX121.
flowchart TD
N0["Learning outcomes"]
N1["41.1 A fixed budget"]
N2["41.2 Marginal benefit"]
N3["Lab — Greedy selection of investments under a budget"]
N4["41.3 Whole-system view"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX121"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["41.1 A fixed budget"]
N2["41.2 Marginal benefit"]
N3["Lab — Greedy selection of investments under a budget"]
N4["41.3 Whole-system view"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX121"]
[Learning outcomes]
|
v
[41.1 A fixed budget]
|
v
[41.2 Marginal benefit]
|
v
[Lab — Greedy selection of investments under a budget]
|
v
[41.3 Whole-system view]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX121]
Learning outcomes
You will (1) optimise the programme under a fixed budget; (2) compare marginal benefits of investments; (3) avoid optimising one measure at the expense of the whole.
41.1 A fixed budget
Greyford's board gives the programme a fixed budget for the next year and asks Aiko how to spend it for the greatest reduction in risk. Options include more simulations, a second triage analyst, security keys for finance and control room staff, better email filtering and more refresher content. Each option has a cost and an estimated effect on expected losses. Optimisation here means choosing a combination that gives the most benefit within the budget, while respecting constraints such as staff burden and the ethical rules for simulations.
41.2 Marginal benefit
The lab ranks options by estimated loss reduction per unit of cost and selects them greedily until the budget runs out. Security keys for finance and control room staff give the largest benefit per unit cost, because they remove the risk of credential theft for the most targeted roles. More simulations give the smallest benefit per unit cost, since the programme already runs them monthly. Aiko presents the result as guidance rather than a precise answer, because the effect estimates come from judgement informed by the evaluation evidence.
Lab — Greedy selection of investments under a budget
# Greedy selection of programme investments by benefit per cost under a budget of 100 units (synthetic).
opts = [("security keys", 40, 120), ("filtering", 30, 60), ("peak analyst", 25, 45), ("refresher content", 15, 18), ("more simulations", 20, 10)]
budget = 100; spent = 0; chosen = []
for name, cost, benefit in sorted(opts, key=lambda o: o[2] / o[1], reverse=True):
print(f"{name}: benefit/cost {benefit / cost:.2f}")
if spent + cost <= budget: chosen.append(name); spent += cost
print("chosen:", chosen, "spent:", spent)
Run with python3 lab_budget.py. Verified output:
security keys: benefit/cost 3.00
filtering: benefit/cost 2.00
peak analyst: benefit/cost 1.80
refresher content: benefit/cost 1.20
more simulations: benefit/cost 0.50
chosen: ['security keys', 'filtering', 'peak analyst'] spent: 95
41.3 Whole-system view
Aiko warns against optimising a single measure. Spending everything on reducing simulation click rates might produce a good chart but little reduction in real losses. Herley (2009) argued that security advice often costs users more effort than the harm it prevents, and optimisation should count staff effort as a real cost. She therefore includes estimated staff hours in each option. The final plan buys security keys, a second analyst at peak times and filtering improvements, and it keeps simulations at their current monthly level.
Worked example
Aiko ranks investments by benefit per cost under a fixed budget, includes staff effort as a cost and selects keys, an analyst and filtering.
Synthetic case. Costs and effects are synthetic; Herley (2009) is real.
Errors and limits
Effect estimates are uncertain. Greedy selection is not always optimal.
Exercises
- EX121 — Best value. Which option had the highest benefit per cost? Rubric: 3 = security keys for targeted roles;; 2 = keys;; 1 = simulations;; 0 = none.
- EX122 — Lab selection. What did the lab select within the budget? Rubric: 3 = keys, filtering and peak analyst for 95 of 100 units;; 2 = three;; 1 = vague;; 0 = none.
- EX123 — Herley's point. Which cost did Aiko include following Herley (2009)? Rubric: 3 = staff effort;; 2 = effort;; 1 = money only;; 0 = none.
Synthesis
Optimisation weighs benefit per cost, counts staff effort and serves real losses, not single measures.
Continue studying — chapter 41 of 50
← Chapter 40 (draft) · Course chapter index · Chapter 42 (draft) →