Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Feedback loops"]
N2["17.2 Delay"]
N3["17.3 Stability"]
N4["17.4 Measuring the loop"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Feedback loops"]
N2["17.2 Delay"]
N3["17.3 Stability"]
N4["17.4 Measuring the loop"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Feedback loops]
|
v
[17.2 Delay]
|
v
[17.3 Stability]
|
v
[17.4 Measuring the loop]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) describe security processes as feedback loops; (2) measure loop delay; (3) avoid unstable responses.
17.1 Feedback loops
Control theory studies systems that measure their output and adjust. Lindiwe sees security operations as a loop: sensors produce logs, analysts detect problems, responders act and the environment changes. If any stage is slow, the loop responds late. She maps Saltmarsh's loop for suspicious logins and finds the slowest stage is waiting for an analyst to review alerts overnight. Prof. Hale notes that feedback thinking shows where delay accumulates. She draws the loop with the time each stage takes in the synthetic records, marking the overnight review stage in red for discussion.
17.2 Delay
Delay matters because attackers move during it. Lindiwe estimates times from synthetic records: detection within minutes, triage within hours during the day but up to twelve hours overnight, and response shortly after triage. She recommends automated containment for high-confidence alerts, such as locking an account after confirmed password guessing, so the loop closes without waiting for a person. She learns that reducing the slowest delay helps more than speeding up stages already fast. The security lead approves a trial of automated locking for one month.
17.3 Stability
Feedback can overreact. If an automated rule locks accounts after a few failed logins, attackers can lock out many staff deliberately, turning a control into a denial of service. Lindiwe proposes gradual responses: slowing login attempts first, then requiring additional verification, and locking only for strong signals. Prof. Hale compares this with damping in control systems, which prevents oscillation. She learns that response strength should match confidence in the signal. The monitoring team adopts the graduated approach and records how often each step is triggered during the trial.
17.4 Measuring the loop
Lindiwe proposes measuring the loop routinely: time to detect, time to triage and time to contain, reported monthly. She notes that averages hide long tails, so she reports medians and the slowest tenth. Prof. Hale asks her to define start and end events precisely, because different analysts may record times differently. She learns that measuring a process consistently is the first step towards improving it, a theme that returns in later chapters on measurement. She drafts a monthly report template for the security lead.
Worked example
Lindiwe maps the login-alert loop, finds overnight triage the slowest stage, proposes automated containment with graduated responses and defines loop metrics.
Synthetic case. Times are synthetic.
Errors and limits
Aggressive automatic lockouts can become a denial of service.
Exercises
- EX049 — Slowest stage. What is the slowest stage in the loop? Rubric: 3 = overnight analyst review;; 2 = partly correct;; 1 = other;; 0 = none.
- EX050 — Gradual response. What comes before locking an account? Rubric: 3 = slowing attempts, then extra verification;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX051 — Loop metrics. Which statistics does she report? Rubric: 3 = medians and the slowest tenth;; 2 = partly correct;; 1 = means;; 0 = none.
Continue studying — lesson 17 (chapter 17 of 50)
← Chapter 16 · Course chapter index · Chapter 18 →
Continue to the next authored lesson.