Chapter 1 — Calculus I

Learning outcomes

You will (1) use rates of change to describe security event volumes; (2) relate derivatives to log monitoring; (3) estimate log storage with an integral.

1.1 The student and the company

Lindiwe Dube begins a five-year engineering course at the fictional Brightwater Polytechnic, supervised by Prof. Marcus Hale. Her placement partner is the fictional Saltmarsh Logistics, which employs about 1,800 people across twelve depots and runs roughly 2,400 networked devices, including 300 servers. Information security at Saltmarsh means protecting the confidentiality, integrity and availability of shipment, customer and payroll data. Prof. Hale explains that every mathematics course will connect to a real security decision at Saltmarsh, so theory is always tested against a working system. She starts in September.

1.2 Rates of change

Calculus starts with rates. If the number of stored security log events is a function of time, its derivative tells Saltmarsh how fast log storage grows. Lindiwe estimates that servers, firewalls and laptops together produce about forty million events per day, a steady rate. When Saltmarsh opens a new depot, the rate itself rises, so the second derivative becomes positive. She learns that planning log retention must use the growth rate, because a plan based only on today's total will run out of space early.

1.3 Monitoring with derivatives

Lindiwe applies the idea to monitoring. A sudden fall in the rate of incoming events from one depot, a large negative derivative, may mean a log forwarder has stopped, not that the depot became quieter. Attackers sometimes disable logging deliberately, so a silent source is itself a security signal. She proposes computing hourly event rates per source and alerting when a rate drops sharply. Prof. Hale notes that this turns a mathematical idea into a detective control for missing evidence. The depot team agrees.

1.4 Planning storage

Saltmarsh's policy keeps security logs for one year online and longer in archive. Lindiwe integrates the event rate over a year, allowing for two new depots, and finds the total grows faster than a simple multiple of today's volume. Prof. Hale asks her to compare full retention with keeping only summarised authentication and firewall events after ninety days. The integral shows large savings, but she notes that summaries can remove detail an investigator later needs, so retention is both a cost and an evidence decision.

Worked example

Lindiwe models log growth as a rate, uses sudden rate drops to detect silent sources and integrates over a year to compare full and summarised retention.

Synthetic case. Brightwater, Saltmarsh and all people are synthetic.

Errors and limits

Treating a quiet log source as safe can hide a disabled forwarder.

Exercises

• EX001 — Daily events. About how many events arrive per day?
  Show marking criteria

  Rubric: 3 = about forty million;; 2 = close;; 1 = wrong;; 0 = none.
• EX002 — Silent source. What might a sudden drop in a source's event rate mean?
  Show marking criteria

  Rubric: 3 = a stopped forwarder;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX003 — Summary risk. What is the risk of summarising old logs?
  Show marking criteria

  Rubric: 3 = losing detail investigators need;; 2 = partly correct;; 1 = vague;; 0 = none.