Chapter 4 — Systems, endpoints and hardware security: competing explanations
Lesson map
Lesson 04 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Explanation A: local admin"]
N2["4.2 Explanation B: remote working"]
N3["4.3 Explanation C: department needs"]
N4["4.4 Overlap"]
N5["4.5 Settings pattern"]
N6["Testing the predictions"]
N7["Rival explanations from operators"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Explanation A: local admin"]
N2["4.2 Explanation B: remote working"]
N3["4.3 Explanation C: department needs"]
N4["4.4 Overlap"]
N5["4.5 Settings pattern"]
N6["Testing the predictions"]
N7["Rival explanations from operators"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[4.1 Explanation A: local admin]
|
v
[4.2 Explanation B: remote working]
|
v
[4.3 Explanation C: department needs]
|
v
[4.4 Overlap]
|
v
[4.5 Settings pattern]
|
v
[Testing the predictions]
|
v
[Rival explanations from operators]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) state competing explanations with mechanisms; (2) predict observable differences; (3) plan how to tell them apart.
4.1 Explanation A: local admin
Users with local administrator rights can change any setting. Saltzer and Schroeder (1975) set out least privilege: each program and user should operate with the fewest privileges needed. Prediction: higher drift among admin devices.
If Explanation A is right, the admin devices should drift more often and on several settings at once, because an administrator can change anything. The seminar sample already showed extra admin users on every drifted laptop. The main data later show 55.0% drift among admin devices against 15.0% among the rest, a risk ratio equal to 3.67.
4.2 Explanation B: remote working
Remote laptops may miss policy refreshes when off the corporate network. Prediction: higher drift among remote devices, especially those with old refresh dates.
The refresh date gives Explanation B a specific test: among remote laptops, drift should be higher for those whose last policy refresh is old, and especially for those with no refresh in the month. A remote laptop that refreshes regularly should behave like an office laptop. If remote laptops drift more regardless of refresh age, something other than missed refreshes is at work, such as users working without IT support close by.
4.3 Explanation C: department needs
Engineering software may require settings changes. Prediction: higher drift in the engineering department.
The prediction is narrower than "engineers drift more". If engineering software needs different settings, drift should concentrate in the settings that software touches, such as firewall rules for licence servers, and should affect engineering laptops whether or not their users are administrators. If engineering laptops drift only when their users are admins, the department is not the explanation; admin rights are. The main results later show engineering at 27.3% against 21.6%, with a chi-square below the significance threshold.
4.4 Overlap
Engineers are more often admins and more often remote, so explanations overlap. Chloé plans stratified comparisons.
This overlap is why a single comparison can mislead. If most remote laptops belong to engineers with admin rights, remote laptops will drift more even if location itself has no effect. Chloé's stratified comparisons compare remote and office laptops within the admin group and within the non-admin group separately. If the gap between remote and office disappears inside each group, the remote effect was mostly admin rights in disguise, which is what the main data later show.
4.5 Settings pattern
Each explanation predicts different settings: admins change many settings; missed refreshes leave settings that recently changed; engineering changes firewall rules for licence servers.
These patterns give a second, independent test of each explanation. If admin devices drift on many settings at once, while remote non-admin devices drift only on settings changed in recent baseline updates, the settings pattern supports A over B. If engineering devices drift mainly on firewall settings, that supports C. Chloé records which settings drifted for every device, not only whether it drifted, so the pattern can be read after the main comparison.
Testing the predictions
Chloé plans three comparisons: admin versus non-admin, remote versus office and engineering versus other departments. She then plans to repeat the remote comparison within admin and non-admin groups separately. If the remote effect disappears within groups, admin rights are the more likely explanation. If it persists, missed refreshes matter independently.
She also plans to examine refresh dates directly: if remote devices with recent refreshes still drift, missed refreshes cannot be the main cause.
Rival explanations from operators
Talking briefly with two Halvorsen administrators, Chloé hears a fourth idea: a software installer used by finance resets the screen lock. She records it as a possible minor explanation for one setting.
Limits
Some explanations may act together, so the analysis looks for patterns rather than a single cause.
Worked example
Dr Mehta suggests writing predictions before data. Chloé adds them to the plan with dates.
Synthetic case. Synthetic.
Errors and limits
Explanations that predict the same pattern cannot be distinguished; seek distinct predictions.
Exercises
- EX021 — Least privilege. Who stated the least privilege principle cited? Rubric: 3 = Saltzer and Schroeder 1975; 2 = partial; 1 = vague; 0 = none.
- EX022 — Remote mechanism. What mechanism links remote work to drift? Rubric: 3 = missed policy refreshes; 2 = partial; 1 = vague; 0 = none.
- EX023 — Department mechanism. Why might engineering drift more? Rubric: 3 = software needs settings changes; 2 = partial; 1 = vague; 0 = none.
- EX024 — Overlap. Why are the explanations hard to separate? Rubric: 3 = engineers often admins and remote; 2 = partial; 1 = vague; 0 = none.
- EX025 — Distinct predictions. How do settings patterns differ? Rubric: 3 = admins many; refresh recent; engineering firewall; 2 = two; 1 = one; 0 = none.
- EX026 — Prediction timing. Why write predictions before data? Rubric: 3 = avoid fitting after; 2 = partial; 1 = vague; 0 = none.
Synthesis
Competing explanations need distinct, pre-stated predictions.
Continue studying — chapter 04 of 08
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →