Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The opening case"]
N2["1.2 The decision"]
N3["Lab — expected costs"]
N4["1.3 Lab result"]
N5["1.4 Beyond expected cost"]
N6["1.5 Sensitivity"]
N7["1.6 Recording"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The opening case"]
N2["1.2 The decision"]
N3["Lab — expected costs"]
N4["1.3 Lab result"]
N5["1.4 Beyond expected cost"]
N6["1.5 Sensitivity"]
N7["1.6 Recording"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The opening case]
|
v
[1.2 The decision]
|
v
[Lab — expected costs]
|
v
[1.3 Lab result]
|
v
[1.4 Beyond expected cost]
|
v
[1.5 Sensitivity]
|
v
[1.6 Recording]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame a cloud security decision with options, costs and risks; (2) estimate expected costs; (3) weigh factors that numbers miss; (4) record the decision and its assumptions.
1.1 The opening case
Inês Carvalho leads cloud security at the fictional insurer Beacon Mutual and is studying on the two-year postgraduate course at the fictional Fenwick Graduate School, with tutor Prof. Sunita Rao. Beacon runs four Kubernetes clusters for claims, quotes, shared services and analytics. During an upgrade to Kubernetes 1.25, the old PodSecurityPolicy mechanism was removed from Kubernetes, as the project had announced, and the replacement, Pod Security admission, was not configured on most namespaces. For three months nothing enforced pod security settings in most of the estate. An internal audit found it; no misuse was detected.
1.2 The decision
Inês must choose how Beacon enforces workload security from now on. Option A: built-in Pod Security admission only. Option B: admission plus a policy engine for checks the built-in profiles do not cover, such as image registry and signature rules. Option C: B plus runtime monitoring of container behaviour. Each option answers the audit finding differently: A relies entirely on correct namespace labels, B adds rules for where images come from and whether they are signed, and C adds detection of behaviour after a container starts. Prof. Rao asks Inês to compare them on cost, risk and how well each would survive the next cluster upgrade.
Lab — expected costs
"""Expected annual cost of three pod security options (synthetic figures, stdlib only)."""
options = { # annual cost (k), yearly probability of a serious workload-config incident, incident impact (k)
"A built-in admission only": (40, 0.10, 900),
"B admission + policy engine": (95, 0.04, 900),
"C admission + engine + runtime monitoring": (210, 0.03, 900),
}
for name, (cost, p, impact) in options.items():
print(f"{name:42} control {cost:>4}k + risk {p*impact:>5.0f}k = {cost + p*impact:>5.0f}k")
Run with python3 lab_decision.py. Verified output:
A built-in admission only control 40k + risk 90k = 130k
B admission + policy engine control 95k + risk 36k = 131k
C admission + engine + runtime monitoring control 210k + risk 27k = 237k
1.3 Lab result
With synthetic estimates, A costs 40k a year plus an expected incident cost of 90k (10% × 900k) = 130k. B costs 95k plus 36k = 131k. C costs 210k plus 27k = 237k. A and B are almost equal on expected cost; C costs much more for a small further reduction. The figures are estimates, so Inês treats the near-tie between A and B as a reason to look beyond expected cost rather than as a decision. Each number in the lab is listed with its source, including the 900k impact estimate, so the risk committee can see which inputs drive the result.
1.4 Beyond expected cost
A and B tie on numbers, but B also covers registry and signature rules that regulators ask about, and reduces dependence on correct namespace labels. It also gives one policy language for future checks. Expected cost ignores how bad the worst case is and how confident the estimates are. For an insurer regulated on how it protects health and claims data, being able to show registry and signature checks matters beyond the numbers. Inês writes these non-financial reasons into the decision record next to the expected costs, so the committee can see that B was chosen for coverage and confidence, not because the arithmetic favoured it.
1.5 Sensitivity
Inês varies the incident probability for A from 5% to 15%. A's total ranges from 85k to 175k; B's from 113k to 149k. B's narrower range is attractive for a risk-averse insurer. A's cost depends heavily on how likely an incident is, because its only protection is labels that the audit showed can be lost. B depends less on that probability, since the policy engine adds checks of its own. Inês shows both ranges in one chart for the committee. Prof. Rao asks her to note that the probabilities are judgements, not measured rates, and Inês adds the source of each one to the decision record.
1.6 Recording
The decision record lists options, estimates, sources, sensitivity, the choice (B) and conditions that would reopen it. Conditions that would reopen the decision include a large change in the incident estimate, a new regulatory requirement for runtime monitoring, or Kubernetes adding registry and signature checks to its built-in admission. Inês also records the range around the 900k impact figure and who produced it, as Prof. Rao asked. The record is stored with the risk committee's minutes and reviewed each year with the risk register.
Worked example
Beacon's risk committee approves option B. Prof. Rao asks Inês to note that the 900k impact figure came from one internal estimate; Inês adds a range and the estimate's author to the record.
Synthetic case. Beacon Mutual, Fenwick Graduate School, people and figures are synthetic.
Errors and limits
Expected-cost models give false precision when inputs are guesses; show ranges.
Exercises
- EX001 — Opening gap. What caused the enforcement gap? Rubric: 3 = PSP removed in 1.25; replacement not configured; 2 = partial; 1 = vague; 0 = none.
- EX002 — Lab totals. Give the three expected totals. Rubric: 3 = A 130k, B 131k, C 237k; 2 = two; 1 = one; 0 = none.
- EX003 — Why B. Why choose B despite the tie? Rubric: 3 = registry/signature rules, less label dependence, narrower range; 2 = two; 1 = one; 0 = none.
- EX004 — Sensitivity ranges. What were the ranges for A and B? Rubric: 3 = A 85-175k; B 113-149k; 2 = partial; 1 = vague; 0 = none.
- EX005 — Impact source. What did Prof. Rao ask Inês to note? Rubric: 3 = impact from one estimate; add range; 2 = partial; 1 = vague; 0 = none.
Synthesis
Decide with explicit options, ranges and recorded assumptions.