Chapter 6 — Calculus II

Chapter 6 — Calculus II

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Exponential decay"]
  N2["6.2 Choosing intervals"]
  N3["6.3 Discounting losses"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Exponential decay"]
  N2["6.2 Choosing intervals"]
  N3["6.3 Discounting losses"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Exponential decay]
    |
    v
[6.2 Choosing intervals]
    |
    v
[6.3 Discounting losses]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) use exponential models for growth and decay; (2) model how control effectiveness decays without maintenance; (3) compare discounting of future losses.

6.1 Exponential decay

In Calculus II, Nadia studies exponential functions. She models how the share of accounts with correct access decays after a review: each month some staff change roles without their access being updated, so correctness falls by a roughly constant fraction. The model predicts that correctness halves over a fixed period if nothing is done. Periodic reviews reset the curve. This gives a mathematical reason why review frequency matters and links calculus to a question Ardwell's auditors already raise. Nadia plots both curves to compare them.

6.2 Choosing intervals

Using the decay model, Nadia asks how often reviews must happen to keep correctness above a target. If correctness falls by a few percent a month, a quarterly review keeps it above the target, while an annual review lets it fall far below by year end. She notes that the decay rate depends on staff movement, so departments with high turnover need more frequent review. The model supports risk-based scheduling rather than one interval for everyone, which ISO/IEC 27002:2022 permits. She shares this result.

6.3 Discounting losses

Nadia also learns to discount future amounts. A control that prevents losses in future years is worth less in today's terms than the same loss avoided now, because money has a time value. She applies a simple discount factor to a three-year investment in backups. The adjustment is modest but changes which of two options looks better. She notes that discounting is standard in investment appraisal and that security investments should be compared on the same basis as others. She states the rate used.

Worked example

Nadia models access correctness as exponential decay, derives risk-based review intervals and discounts future avoided losses.

Synthetic case. Decay rates and investment figures are synthetic.

Errors and limits

Real decay is uneven. Discount rates are policy choices.

Exercises

• EX016 — Decay driver. What makes access correctness decay after a review? Rubric: 3 = staff changing roles without access updates;; 2 = role changes;; 1 = vague;; 0 = none.
• EX017 — High turnover. Which departments need more frequent review? Rubric: 3 = those with high staff turnover;; 2 = turnover;; 1 = vague;; 0 = none.
• EX018 — Time value. Why is a future avoided loss worth less today? Rubric: 3 = money has a time value;; 2 = discounting;; 1 = vague;; 0 = none.

Synthesis

Exponential models explain why controls decay and how review intervals and investments should be set.

Continue studying — chapter 06 of 50

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →