Chapter 41 — Security governance, risk and compliance: system optimization
Lesson map
Lesson 41 published. Map, example, EX121.
flowchart TD
N0["Learning outcomes"]
N1["41.1 The budget problem"]
N2["41.2 Finding the best set"]
N3["Lab — Best control set within a budget"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX121"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["41.1 The budget problem"]
N2["41.2 Finding the best set"]
N3["Lab — Best control set within a budget"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX121"]
[Learning outcomes]
|
v
[41.1 The budget problem]
|
v
[41.2 Finding the best set]
|
v
[Lab — Best control set within a budget]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX121]
Learning outcomes
You will (1) choose control investments under a budget; (2) compare optimal and intuitive choices; (3) recognise the limits of optimisation.
41.1 The budget problem
Ardwell's board approves two hundred thousand for new security controls next year. Nadia lists six options with costs and estimated reductions in expected annual loss: multi-factor authentication for remote access, offline backups, a vendor access broker extension, card tokenisation, an awareness refresh and log monitoring. Total costs exceed the budget, so choices must be made. She frames this as an optimisation problem: maximise total estimated loss reduction while keeping cost within the budget. Framing it this way also makes explicit that each option's value rests on a workshop estimate of loss reduction.
41.2 Finding the best set
With only six options, the lab checks every combination. The best set within budget costs one hundred and ninety thousand and reduces estimated loss by six hundred and thirty thousand: multi-factor authentication, offline backups and card tokenisation. Nadia compares this with an intuitive choice that management had suggested, the broker extension and log monitoring, which uses most of the budget for a much smaller reduction. Exhaustive search shows clearly how much value intuition can leave behind. The intuitive choice targets vendor access and logging, which matter, but buys far less estimated reduction per thousand spent.
Lab — Best control set within a budget
"""Choose controls under a budget to maximise expected loss reduction (exhaustive search)."""
from itertools import combinations
opts = [("MFA for remote access", 40, 150), ("offline backups", 60, 220), ("vendor access broker", 80, 190),
("card tokenisation", 90, 260), ("awareness refresh", 20, 40), ("log monitoring", 70, 120)]
B = 200; best = (0, 0, ())
for r in range(len(opts)+1):
for s in combinations(opts, r):
c = sum(o[1] for o in s); g = sum(o[2] for o in s)
if c <= B and g > best[0]: best = (g, c, s)
print(f"budget {B}k; best reduction {best[0]}k at cost {best[1]}k")
for o in best[2]: print(" -", o[0])
Run with python3 lab_budget.py. Verified output:
budget 200k; best reduction 630k at cost 190k
- MFA for remote access
- offline backups
- card tokenisation
41.3 Limits
Nadia reports the result with caveats. Reduction estimates come from workshops and are uncertain. Options may interact; backups and tokenisation address different risks, but other pairs might overlap. Some benefits, such as better evidence for audits, are not captured. Gordon and Loeb (2002) remind her that the value of investment depends on vulnerability and potential loss, not cost alone. She recommends using the optimal set as a starting point for discussion, with sensitivity checks on the most uncertain estimates. A sensitivity check might show, for example, whether halving the tokenisation estimate would change the chosen set.
Worked example
Nadia finds the best set within two hundred thousand, saving six hundred and thirty thousand at a cost of one hundred and ninety thousand, and states its limits.
Synthetic case. Costs and reductions are synthetic; Gordon and Loeb (2002) is real.
Errors and limits
Estimates are uncertain. Interactions between controls are ignored.
Exercises
- EX121 — Best set. Which controls form the best set? Rubric: 3 = MFA, offline backups and card tokenisation;; 2 = three;; 1 = broker;; 0 = none.
- EX122 — Best cost. At what cost does the best set deliver its 630k reduction? Rubric: 3 = 190k;; 2 = 190;; 1 = 200;; 0 = none.
- EX123 — Investment value. According to Gordon and Loeb, what drives the value of security investment? Rubric: 3 = vulnerability and potential loss;; 2 = not cost alone;; 1 = vague;; 0 = none.
Synthesis
Optimisation reveals better choices than intuition but must be read with its uncertainties.
Continue studying — chapter 41 of 50
← Chapter 40 (draft) · Course chapter index · Chapter 42 (draft) →