Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Feedback in security"]
N2["17.2 Simulating a rate limiter"]
N3["Lab — Adaptive rate limiter gains"]
N4["17.3 Lag and oscillation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Feedback in security"]
N2["17.2 Simulating a rate limiter"]
N3["Lab — Adaptive rate limiter gains"]
N4["17.3 Lag and oscillation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Feedback in security]
|
v
[17.2 Simulating a rate limiter]
|
v
[Lab — Adaptive rate limiter gains]
|
v
[17.3 Lag and oscillation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) describe feedback loops in security operations; (2) simulate an adaptive rate limiter; (3) recognise oscillation and lag in control systems.
17.1 Feedback in security
A feedback loop measures an output, compares it with a target and adjusts an input. Sofia finds feedback throughout security operations: a rate limiter that tightens when failed logins rise, an autoscaler that adds capacity during a traffic flood, and an organisation that adjusts controls after incidents. Control theory, which she studies for engineering, gives tools to reason about whether such loops settle smoothly, react too slowly or overreact. Daniel notes that badly tuned security automation can cause outages, which attackers may exploit deliberately by triggering it.
17.2 Simulating a rate limiter
The passenger app's login service uses an adaptive rate limiter: if failed logins in a minute exceed a target, the allowed request rate is reduced; if they fall below, it is relaxed. Sofia simulates this with synthetic attack traffic arriving at minute five and stopping at minute fifteen. With a proportional gain that is too high, the allowed rate swings up and down, alternately blocking legitimate users and letting attacks through. With a moderate gain, it settles. The lab below prints both runs so she can see the difference rather than just reading about it.
Lab — Adaptive rate limiter gains
# Adaptive rate limiter (proportional control) on synthetic failed-login traffic.
def run(gain, minutes=24, target=50):
allowed, out = 200.0, []
for t in range(minutes):
attack = 400 if 5 <= t < 15 else 0
failures = min(allowed, 40 + attack) * (0.9 if attack else 0.3)
allowed = max(20.0, min(400.0, allowed - gain * (failures - target)))
out.append(round(allowed))
return out
for g in (2.5, 0.6):
r = run(g)
swings = sum(1 for a, b, c in zip(r, r[1:], r[2:]) if (b - a) * (c - b) < 0)
print(f"gain {g}: allowed/min = {r}")
print(f" direction changes: {swings}")
Run with python3 lab_feedback.py. Verified output:
gain 2.5: allowed/min = [295, 390, 400, 400, 400, 20, 100, 20, 100, 20, 100, 20, 100, 20, 100, 195, 290, 385, 400, 400, 400, 400, 400, 400]
direction changes: 9
gain 0.6: allowed/min = [223, 246, 268, 291, 314, 174, 110, 81, 67, 61, 58, 57, 56, 56, 56, 78, 101, 124, 147, 170, 192, 215, 238, 261]
direction changes: 1
17.3 Lag and oscillation
Two problems recur in feedback systems: lag, where the response arrives too late, and oscillation, where the response overshoots repeatedly. A rate limiter measuring over long windows lags behind sudden attacks; one reacting to every second may oscillate. Sofia relates this to incident response: an organisation that changes policy only once a year lags, while one that reverses decisions weekly oscillates and confuses staff. She proposes that automated controls have bounded adjustment sizes, minimum and maximum limits and human review when limits are reached, to keep feedback stable.
Worked example
Sofia simulates an adaptive rate limiter with two gains, shows oscillation at high gain and proposes bounded, reviewed automatic adjustments.
Synthetic case. Traffic and limiter parameters are synthetic.
Errors and limits
Simple proportional models ignore attacker adaptation. Simulation results depend on assumed traffic shapes.
Exercises
- EX049 — Automation exploit. How might attackers exploit badly tuned security automation? Rubric: 3 = trigger it deliberately to cause outages for legitimate users;; 2 = trigger;; 1 = vague;; 0 = none.
- EX050 — High gain result. What happened in the lab with the high gain? Rubric: 3 = allowed rate oscillated, swinging between blocking users and admitting attacks;; 2 = oscillated;; 1 = settled;; 0 = none.
- EX051 — Stabilising proposal. Name two safeguards Sofia proposes for automated controls. Rubric: 3 = bounded adjustments, min and max limits, human review at limits (two);; 2 = one;; 1 = vague;; 0 = none.
Synthesis
Security automation is a feedback system, and it needs tuning and bounds to avoid lag and oscillation.
Continue studying — chapter 17 of 50
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →