Chapter 41 — Security architecture and engineering: system optimization

Lesson map

Lesson 41 published. Map, example, EX121.

flowchart TD
  N0["Learning outcomes"]
  N1["41.1 Choosing under constraints"]
  N2["41.2 Greedy versus exhaustive"]
  N3["Lab — Greedy and exhaustive control selection"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX121"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["41.1 Choosing under constraints"]
  N2["41.2 Greedy versus exhaustive"]
  N3["Lab — Greedy and exhaustive control selection"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX121"]

[Learning outcomes]
    |
    v
[41.1 Choosing under constraints]
    |
    v
[41.2 Greedy versus exhaustive]
    |
    v
[Lab — Greedy and exhaustive control selection]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX121]

Learning outcomes

You will (1) frame control selection as an optimisation under budget; (2) compare greedy and exhaustive selection on synthetic data; (3) recognise limits of numeric optimisation in security.

41.1 Choosing under constraints

Corvia's security budget for next year cannot fund every proposed control. Sofia frames the choice as optimisation: each candidate control has a cost and an estimated risk reduction from the risk assessment in chapter 24, and the goal is to maximise total reduction within budget. This is a version of the knapsack problem from discrete mathematics. Framing the decision this way makes assumptions explicit and lets stakeholders see why one control was preferred over another, rather than relying on whoever argues loudest in a budget meeting.

41.2 Greedy versus exhaustive

Sofia compares two methods on eight synthetic candidate controls. A greedy method picks controls in order of reduction per unit cost until the budget is used. An exhaustive search tries every combination, feasible here because eight items give only 256 subsets. The lab below shows that greedy selection comes close but misses the best combination, because it fills the budget with small efficient items and leaves no room for one large, valuable control. For larger problems exhaustive search becomes impossible, and engineers use better algorithms or accept approximations knowingly.

Lab — Greedy and exhaustive control selection

# Greedy vs exhaustive control selection under budget (synthetic costs and risk reductions).
from itertools import combinations
C = {"mfa-admins": (8, 10), "egress-filter": (15, 13), "log-review": (20, 14), "hsm-keys": (50, 34),
     "edr-depots": (35, 20), "phish-training": (12, 9), "backup-offline": (25, 17), "waf": (30, 15)}
B = 100
g, cost, val = [], 0, 0
for k, (c, v) in sorted(C.items(), key=lambda kv: kv[1][1] / kv[1][0], reverse=True):
    if cost + c <= B: g.append(k); cost += c; val += v
best = max((s for r in range(len(C) + 1) for s in combinations(C, r) if sum(C[k][0] for k in s) <= B),
           key=lambda s: sum(C[k][1] for k in s))
print(f"greedy:     value {val}, cost {cost}, {sorted(g)}")
print(f"exhaustive: value {sum(C[k][1] for k in best)}, cost {sum(C[k][0] for k in best)}, {sorted(best)}")

Run with python3 lab_knapsack.py. Verified output:

greedy:     value 63, cost 80, ['backup-offline', 'egress-filter', 'log-review', 'mfa-admins', 'phish-training']
exhaustive: value 74, cost 98, ['backup-offline', 'egress-filter', 'hsm-keys', 'mfa-admins']

41.3 Limits of the numbers

Optimisation is only as good as its inputs. Risk-reduction estimates are uncertain, controls interact, so two controls may overlap rather than add, and some controls are mandatory for compliance regardless of score. Sofia runs the selection with low and high estimates and shows which controls are chosen in every scenario; those are robust choices. She presents the result as decision support, not a decision. Daniel adds that the exercise's main value is the conversation it forces about estimates, which often reveals that nobody knows how much a popular control actually reduces risk.

Worked example

Sofia frames next year's controls as a budgeted knapsack problem, shows greedy selection missing the optimum on synthetic data and identifies robust choices across estimate ranges.

Synthetic case. Controls, costs and reductions are synthetic.

Errors and limits

Additive risk reduction is unrealistic when controls overlap. Mandatory controls must be fixed before optimisation.

Exercises

• EX121 — Problem type. Which classic problem does budgeted control selection resemble?
  Show marking criteria

  Rubric: 3 = the knapsack problem;; 2 = knapsack;; 1 = sorting;; 0 = none.
• EX122 — Greedy shortfall. In the lab, how did greedy selection compare with the exhaustive optimum?
  Show marking criteria

  Rubric: 3 = greedy reached 63 at cost 80; the optimum was 74 at cost 98 and included hsm-keys;; 2 = both values;; 1 = equal;; 0 = none.
• EX123 — Robust choice. What makes a control a robust choice?
  Show marking criteria

  Rubric: 3 = it is selected under both low and high estimates;; 2 = both scenarios;; 1 = highest score;; 0 = none.

Synthesis

Optimisation frames security investment clearly, but uncertain and interacting estimates make its output advice, not a verdict.

Continue studying — chapter 41 of 50

← Chapter 40 (draft) · Course chapter index · Chapter 42 (draft) →