Chapter 41 — Optimize decisions with measured tradeoffs
Lesson map
Lesson 41 published. Map, example, EX081.
flowchart TD
N0["Learning outcomes and connection"]
N1["41.1 Beyond a single speed metric"]
N2["41.2 Decision tables and weights"]
N3["41.3 Sensitivity"]
N4["41.5 Presenting decisions"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX081"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["41.1 Beyond a single speed metric"]
N2["41.2 Decision tables and weights"]
N3["41.3 Sensitivity"]
N4["41.5 Presenting decisions"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX081"]
[Learning outcomes and connection]
|
v
[41.1 Beyond a single speed metric]
|
v
[41.2 Decision tables and weights]
|
v
[41.3 Sensitivity]
|
v
[41.5 Presenting decisions]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX081]
Learning outcomes and connection
After this chapter you can (1) express a response-policy choice as a multi-objective decision with explicit costs of error; (2) build a decision table from measured or modelled quantities; (3) run a sensitivity analysis that finds where the choice reverses; and (4) present the decision with its assumptions to accountable owners. It builds on Chapters 7, 26, 29 and 36 and prepares Chapters 42 and 49.
41.1 Beyond a single speed metric
"Mean time to contain" rewards aggressive containment; it does not count the disruption caused by false or excessive actions, the analyst effort, or the cost of letting an attacker persist. A response policy is a choice among alternatives with several consequences. Make them explicit: expected business disruption, probability of attacker persistence, analyst effort, evidence loss, and constraints that are not tradable (safety, legal obligations).
The three HVSS containment policies in Lab 41 show the problem clearly. Judged by containment speed alone, isolate_immediately would win outright for every asset. Its six expected hours of business disruption per incident, against half an hour for monitor_then_contain, are invisible to a time-to-contain metric.
41.2 Decision tables and weights
With consequences measured or modelled per alternative, a simple approach is a weighted cost: convert each consequence to a common unit by an exchange rate — for example, how many hours of business disruption is one percentage point of persistence probability worth? Exchange rates are value judgements owned by accountable people, not by the engineer. The engineer's job is to make the dependence of the choice on these judgements visible. Constraints filter alternatives before weighting. In Lab 41, the exchange rates are c_persist = 60 and c_analyst = 0.5, each expressed in disruption-hour equivalents.
41.3 Sensitivity
One-at-a-time sensitivity varies one parameter across a plausible range; switching values are the parameter values where the preferred option changes. When a switching value lies inside the plausible range, the decision is fragile and the parameter deserves better measurement. Global methods consider several parameters together (Saltelli et al., Global Sensitivity Analysis: The Primer, 2008).
In Lab 41, the switching value between immediate isolation and isolate-after-review is exactly 50. At that value both cost 8.50, since 6 + 0.02c + 1.5 equals 2.5 + 0.08c + 2 when c = 50. The baseline of 60 is close to that boundary, so the persistence weight deserves better measurement.
41.4 Worked example (synthetic): three containment policies at HVSS
"""Lab 41 (synthetic): choosing a containment policy with weighted objectives and a sensitivity sweep.
Scores are expected values per incident from a synthetic model; lower is better."""
P = { # policy: (expected business disruption hours, P(attacker persists 24h), analyst hours)
"isolate_immediately": (6.0, 0.02, 3.0),
"isolate_after_review": (2.5, 0.08, 4.0),
"monitor_then_contain": (0.5, 0.25, 6.0)}
def cost(p, c_disrupt, c_persist, c_analyst):
d, q, a = P[p]; return d * c_disrupt + q * c_persist + a * c_analyst
base = dict(c_disrupt=1.0, c_persist=60.0, c_analyst=0.5)
for p in P: print(f"{p:22s} cost = {cost(p, **base):6.2f}")
print("best at baseline:", min(P, key=lambda p: cost(p, **base)))
print("sweep cost of persistence (disruption-hour equivalents):")
prev = None
for cp in range(0, 201, 5):
b = min(P, key=lambda p: cost(p, base["c_disrupt"], cp, base["c_analyst"]))
if b != prev: print(f" from c_persist={cp:3d}: {b}"); prev = b
Expected output:
isolate_immediately cost = 8.70
isolate_after_review cost = 9.30
monitor_then_contain cost = 18.50
best at baseline: isolate_immediately
sweep cost of persistence (disruption-hour equivalents):
from c_persist= 0: monitor_then_contain
from c_persist= 10: isolate_after_review
from c_persist= 50: isolate_immediately
At the baseline exchange rate (one unit of persistence probability valued at 60 disruption-hour equivalents), immediate isolation is cheapest, narrowly ahead of isolate-after-review (8.70 vs 9.30). The sweep shows the switching values: below about 5.9 monitoring-then-containing wins (the sweep, in steps of 5, first shows the change at 10); between about 5.9 and 50, isolate-after-review; above 50, immediate isolation. The baseline (60) lies just above a switching value: a modest disagreement about the value of persistence reverses the choice. Two consequences for HVSS: (1) the decision was escalated to the service owners and the CISO with the switching value shown, not presented as an engineering result; (2) the parameter with most influence — persistence probability under review delay — was measured in the next exercise rather than assumed. The owners chose isolate-after-review for servers (where disruption is costlier, raising the effective disruption weight) and immediate isolation for workstations.
41.5 Presenting decisions
Present: alternatives, consequences with uncertainty, constraints, exchange rates and their owners, the choice at baseline, switching values, and what measurement would reduce the uncertainty. One page, one chart of the sweep.
For the HVSS choice, that page showed the three policies with baseline costs 8.70, 9.30 and 18.50, and the CISO and service owners as owners of the exchange rates. It also showed the switching value of 50 against the baseline of 60. The measurement it proposed was persistence probability under review delay. Owners can then disagree about the exchange rate while still seeing exactly what their disagreement changes.
41.6 Errors and limits
- One metric standing in for many consequences.
- Engineers silently choosing exchange rates.
- Point estimates without sensitivity.
- Models treated as data.
The HVSS analysis avoided each error, which is why its recommendation reached the owners in a usable form. Mean time to contain would have favoured immediate isolation for every asset. The exchange rate of 60 was shown to the service owners and CISO rather than fixed quietly by the engineer. The sweep exposed how close the baseline lay to a switch, and the persistence probabilities were treated as synthetic model outputs to be measured.
Exercises — chapter 41
EX081 — Switching value. Objective: compute analytically. Inputs: Lab 41 table. Steps: derive the switching value of c_persist between immediate isolation and isolate-after-review with c_disrupt = 1 and c_analyst = 0.5; repeat for c_disrupt = 2 (servers). Expected evidence: two values with algebra. Rubric: 3 = 50 and 108.3; 2 = one; 1 = setup only; 0 = none.
EX082 — Constraint first. Objective: apply hard constraints. Inputs: add the constraint "for patient-facing systems, expected disruption must not exceed 3 h". Steps: filter the alternatives, choose among the remaining at baseline and state the residual risk. Expected evidence: filtered table and decision. Rubric: 3 = immediate isolation excluded (6 h); choose between review (2.5 h) and monitor (0.5 h) → review at baseline (9.30 vs 18.50); residual persistence risk 8% stated with owner; 2 = partial; 1 = ignores constraint; 0 = none.
Chapter synthesis
Choose response policies as multi-objective decisions: filter by hard constraints, weight consequences with exchange rates owned by accountable people, find switching values and measure the parameters that decide the outcome.
Continue studying — chapter 41 of 50
← Chapter 40 · Course chapter index · Chapter 42 →
Continue to the next authored lesson.