Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Feedback in identity operations"]
N2["17.2 Thresholds"]
N3["17.3 Oscillation and self-harm"]
N4["17.4 Human in the loop"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Feedback in identity operations"]
N2["17.2 Thresholds"]
N3["17.3 Oscillation and self-harm"]
N4["17.4 Human in the loop"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Feedback in identity operations]
|
v
[17.2 Thresholds]
|
v
[17.3 Oscillation and self-harm]
|
v
[17.4 Human in the loop]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) view identity operations as feedback loops; (2) set thresholds for sign-in alerts; (3) avoid oscillating automated responses.
17.1 Feedback in identity operations
Identity operations form feedback loops. Monitoring measures sign-in failures, lockouts and risky events; people or automation compare them with expectations; and actions follow, such as requiring a second factor or locking an account. A good loop corrects problems quickly and steadily. A poor one reacts too slowly, letting an attack continue, or too aggressively, locking out legitimate staff. Seeing operations as feedback helps Sana design alerts and automated responses that keep the system stable. Measuring how long each loop takes to respond shows where it is too slow.
17.2 Thresholds
An account lockout threshold turns a count of failed sign-ins into a decision. Too low, and staff who mistype a few times are locked out, flooding the service desk; too high, and guessing attempts continue longer. NIST SP 800-63B-4 discusses limiting failed attempts as part of authenticator management. Sana sets thresholds from measured normal behaviour, uses a time window so old failures expire, and reviews thresholds after rollout, since passkeys change failure patterns substantially. Each threshold has a named owner who reviews it quarterly.
17.3 Oscillation and self-harm
Automated responses can oscillate or cause harm. If many failed sign-ins trigger lockouts, and lockouts generate reset requests that themselves fail, the loop amplifies a small problem. Worse, an attacker who knows a username can deliberately lock out that person by failing on purpose. Sana prefers responses that slow attempts progressively or require additional verification, rather than hard lockouts, so that the control limits guessing without handing anyone an easy way to deny service to colleagues. Alerts accompany these responses so analysts can see patterns.
17.4 Human in the loop
Many identity responses keep a person in the loop: an alert reaches an analyst, who decides whether a risky sign-in is genuine. People add judgement but also delay and fatigue. Sana designs alerts that include context, such as the user's usual locations and devices, and writes runbooks for common cases. She measures time from alert to decision, because a loop with a person in it is only as fast as that person can act, and alerts nobody reads provide no control at all.
Worked example
Replacing a hard five-failure lockout with progressive delays cuts synthetic lockout tickets by about two thirds while keeping guessing attempts slow.
Synthetic case. Thresholds, tickets and rates are synthetic.
Errors and limits
Hard lockouts let anyone who knows a username deny that person access by failing on purpose.
Exercises
- EX049 — Low threshold effect. What happens when a lockout threshold is too low? Rubric: 3 = staff locked out, desk flooded;; 2 = lockouts;; 1 = vague;; 0 = none.
- EX050 — Lockout abuse. How can hard lockouts be abused? Rubric: 3 = attacker fails deliberately to lock someone out;; 2 = deny service;; 1 = vague;; 0 = none.
- EX051 — Progressive response. What does Sana prefer to hard lockouts? Rubric: 3 = progressive slowing or extra verification;; 2 = delays;; 1 = no limit;; 0 = none.
Synthesis
Identity controls are feedback loops; good thresholds, progressive responses and supported analysts keep them stable.
Continue studying — chapter 17 of 50
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →