Chapter 35 — Design studio II
Lesson map
Lesson 35 published. Map, example, EX103.
flowchart TD
N0["Learning outcomes"]
N1["35.1 Problem"]
N2["35.2 Copy"]
N3["35.3 Review"]
N4["Practice note"]
N5["35.1b Accessibility and export truth"]
N6["Field note — CFO explain task"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX103"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["35.1 Problem"]
N2["35.2 Copy"]
N3["35.3 Review"]
N4["Practice note"]
N5["35.1b Accessibility and export truth"]
N6["Field note — CFO explain task"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX103"]
[Learning outcomes]
|
v
[35.1 Problem]
|
v
[35.2 Copy]
|
v
[35.3 Review]
|
v
[Practice note]
|
v
[35.1b Accessibility and export truth]
|
v
[Field note — CFO explain task]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX103]
Learning outcomes
You will (1) redesign CNHP's coverage UI against under-claim principles; (2) defend the design in a review; (3) produce UI copy that refuses empty scores.
35.1 Problem
Stakeholders want a big green percentage. Design a CNHP dashboard that shows planned, observed and not-seen techniques and refuses a single security score.
At ABP the plant manager first asked for one percentage that would show whether CNHP was working. Lena's team explained that any single figure would mix observed techniques, conduit drift and SIS-B reachability, which need different owners and different budgets. The resulting screen gives each measure its own line with its denominator visible, and the planned-but-not-seen techniques are listed by id so the manager can ask which ones matter before approving the next phase.
35.2 Copy
71% of planned ICS techniques observed — not a residual-risk score. Button: export denominator. Show SIS reachable? as a separate yes/no.
Lena's team tested this wording with the plant manager and two shift leads before release. One shift lead read an early draft that said only seventy-one percent and assumed the plant was seventy-one percent safe, which is exactly the misreading the caveat prevents. The export button produces the list of the 44 planned techniques with each marked observed or not seen, and the SIS-B line never shows a percentage, because reachability is either true or false on the day of the check.
35.3 Review
Plant reviewers ask for a red/yellow/green badge on each production line; the studio holds to the measurement chapter rules.
Synthetic case — Ashford Batch Plant. Studio II killed the badge; the dashboard lists planned-not-seen techniques by id and SIS reachability separately.
Critics in the studio argued that executives would not read a list. Lena's team answered with the manager's actual decision: which conduits to fund and close next, which a colour cannot express. The removed badge also had no defined rule for turning yellow, so two reviewers had already disagreed about its colour on the same data. Replacing it with named items ended that argument and gave each item an owner.
35.4 Errors and limits
A view "just for executives" is how an empty score usually returns, so CNHP dashboard changes need CODEOWNERS approval.
At ABP a later request asked for an executive-only summary view with a single coloured dial. Lena's team declined it during code review, citing the studio decision and the measurement rules, and offered instead a one-page export with the same three numbers and their denominators. Requiring a code owner to approve every change to the dashboard interface means this argument is settled by a named reviewer who knows the history, rather than reopened quietly by whoever edits the screen next.
Practice note
User research task: explain this number to a plant manager without saying we are safe. If users cannot, the copy has failed.
35.1b Accessibility and export truth
CNHP metrics that under-claim must still be readable for the shift supervisor: large type for the fraction, plain language for the caveat, keyboard access to the denominator export. If the dashboard and the CSV export disagree, Lena's report uses the export. Build exports first; treat UI as a view.
Narrative exports generated from the same query as the UI paste into reports without screenshot ambiguity. A caveat hidden in a tooltip never appears on the control-room wall screen, where nobody hovers, and the empty score comes back.
Lena checks every release against the export.
Field note — CFO explain task
In user research, three managers explained the coverage fraction as how safe we are. After copy changes that forbade that reading and surfaced SIS reachability separately, the same task produced explanations about planned checks and open findings instead.
Every export carries the query version and the time it ran in its first line.
35.5 Worked example — the studio critique (synthetic ABP)
Studio II's brief: a plant manager must decide whether to approve the next CNHP phase from one screen. Lena's team shows three numbers with denominators — 31 of 44 planned ATT&CK for ICS techniques observed in testing, 6 of 9 conduits matching the zone design, SIS-B reachable from any routed zone: no — plus a short list of open high findings. Critics argued for a single risk badge; the team replied that the manager's decision depends on which conduits remain open, not on an average. The accepted design puts the open-conduit list first, because it is the item the manager can actually fund.
Exercises
- EX103 — Copy. Subtitle under the coverage number. Rubric: 3 = denies residual-risk reading; 2 = weak caveat; 1 = none; 0 = implies safety.
- EX104 — Badge. One sentence refusing a RAG badge. Rubric: 3 = clear + alternative; 2 = refuse only; 1 = accepts; 0 = none.
- EX105 — Export. Columns in denominator export. Rubric: 3 = technique id, planned, observed, notes; 2 = partial; 1 = just %; 0 = none.
Synthesis
UI that teaches the metric, not a traffic light of vibes.
Continue studying — chapter 35 of 50
← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →