Chapter 7 — Probability and statistics | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Probability and statistics

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Random events"]
  N2["7.2 Summarising sign-in times"]
  N3["7.3 Rare events and base rates"]
  N4["7.4 Uncertainty in estimates"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Random events"]
  N2["7.2 Summarising sign-in times"]
  N3["7.3 Rare events and base rates"]
  N4["7.4 Uncertainty in estimates"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 Random events]
    |
    v
[7.2 Summarising sign-in times]
    |
    v
[7.3 Rare events and base rates]
    |
    v
[7.4 Uncertainty in estimates]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) model random events such as lockouts; (2) summarise sign-in times with medians and percentiles; (3) reason about rare events.

7.1 Random events

Account lockouts, forgotten security keys and authentication errors occur at random times but at fairly stable average rates. Modelling them as random events with a known rate lets Sana estimate, for example, how many lockouts the service desk should expect on a Monday morning. A Poisson model, which describes counts of independent events in a fixed period, is a reasonable first approximation. She checks the model against desk records, since events that cluster, such as many lockouts after a password policy change, break the independence assumption.

7.2 Summarising sign-in times

Sign-in duration varies. The mean can be pulled up by a few very slow sign-ins, so Sana reports the median as the typical experience and the 95th percentile to show how slow the worst common cases are. If the median is two seconds but the 95th percentile is twelve, one in twenty sign-ins is frustrating, which users will notice and complain about. She always reports the number of samples and the period, so readers can judge whether the summary reflects normal conditions or an unusual week.

7.3 Rare events and base rates

Suspicious sign-ins are rare among millions of legitimate ones. A detection rule that flags one percent of normal sign-ins would produce thousands of alerts daily, almost all false. This is the base-rate problem: even an accurate detector produces mostly false alarms when the event it looks for is rare. Sana uses it to explain why the council's sign-in monitoring must combine several signals, such as new device, impossible travel and failed second factors, rather than alerting on any single unusual feature.

7.4 Uncertainty in estimates

Estimates from samples carry uncertainty. If a pilot of 200 staff sees 6 lockouts in a week, the true weekly rate for that group is uncertain, and Sana reports an interval rather than a single number. Larger samples give narrower intervals. Reporting uncertainty helps managers decide wisely: a wide interval suggests waiting for more data before committing desk staff, while a narrow one supports a firm plan. Ignoring uncertainty leads to overconfident decisions that later look like mistakes. Intervals are recalculated as more weeks of data arrive.

Worked example

With an average of four lockouts per Monday morning hour, a Poisson model gives about a 21 percent chance of six or more in one hour, which Sana uses to plan desk cover.

Synthetic case. Rates and counts are synthetic.

Errors and limits

Reporting only a mean sign-in time hides the slow tail that users actually experience.

Exercises

EX019 — Poisson assumption. What assumption does a Poisson lockout model rely on? Rubric: 3 = independent events at a stable rate;; 2 = independence;; 1 = normality;; 0 = none.
EX020 — Percentile meaning. What does a 95th percentile of twelve seconds mean? Rubric: 3 = one in twenty sign-ins takes twelve seconds or more;; 2 = slow tail;; 1 = average;; 0 = none.
EX021 — Base-rate effect. Why does a 1% false-alarm rate overwhelm monitoring? Rubric: 3 = legitimate sign-ins vastly outnumber suspicious ones;; 2 = base rate;; 1 = vague;; 0 = none.

Synthesis

Simple probability models and robust summaries make identity operations measurable and plannable.

Continue studying — chapter 07 of 50

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →