◇ OpenCyber Academy
Engineering · Chapter 35 · English

Chapter 35 — Design studio II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 35 — Design studio II

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 The brief"]
  N2["35.2 The design"]
  N3["35.3 Testing and revision"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 The brief"]
  N2["35.2 The design"]
  N3["35.3 Testing and revision"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX103"]
[Learning outcomes]
    |
    v
[35.1 The brief]
    |
    v
[35.2 The design]
    |
    v
[35.3 Testing and revision]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) design a board reporting pack for security risk; (2) test it with real readers; (3) revise for clarity and decision value.

35.1 The brief

In the second studio, Nadia's team designs a quarterly board pack on security risk for Ardwell. The brief asks for no more than four pages, a focus on decisions and honest uncertainty. The team interviews two board members. One wants to know whether risk is rising or falling. The other wants to know what the board is being asked to decide. Neither wants technical detail, but both want to trust the numbers and know where they came from. The two directors' questions become the first two pages of the design: trends and decisions requested.

35.2 The design

The pack opens with decisions requested. Page two shows the top five residual risks with expected loss ranges and trend arrows. Page three shows control performance by family with red items first. Page four lists major findings, exceptions and incidents with owners and dates. An appendix explains methods and assumptions. The team avoids heat maps without numbers, after reading Cox (2008) on how risk matrices can mislead, and uses ranges and plain sentences instead. Ranges and plain sentences also let directors see how uncertain each expected loss estimate is.

35.3 Testing and revision

The team tests the pack with three volunteers acting as board members. One misreads a trend arrow as good news when risk was rising. Another cannot find who owns a red control. The team adds labelled arrows with words and puts owner names beside each red item. A volunteer asks why ransomware residual risk fell; the team adds a sentence linking the drop to tested backups. Nadia learns that readers reveal confusion that designers cannot see. The labelled trend arrows, for example, fix a misreading that the designers themselves never noticed.

Worked example

Nadia's team designs a four-page board pack with decisions first, tests it with volunteers and clarifies trends and ownership.

Synthetic case. The pack and testers are synthetic; Cox (2008) is real.

Errors and limits

Volunteers are not real directors. Short packs omit detail.

Exercises

Synthesis

Board reports work when they lead with decisions, show honest ranges and are tested with readers.

Continue studying — chapter 35 of 50

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →