Chapter 1 — Advanced security decision-making

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["1.1 What makes a decision organization-scale"]
  N2["1.2 Framing: the decision statement"]
  N3["1.3 Objectives in service units"]
  N4["1.4 Three decision rules"]
  N5["1.5 Probabilities you do not know: sensitivity and t"]
  N6["1.6 Value of information"]
  N7["1.7 Judgement errors that distort security decisions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["1.1 What makes a decision organization-scale"]
  N2["1.2 Framing: the decision statement"]
  N3["1.3 Objectives in service units"]
  N4["1.4 Three decision rules"]
  N5["1.5 Probabilities you do not know: sensitivity and t"]
  N6["1.6 Value of information"]
  N7["1.7 Judgement errors that distort security decisions"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]

[Learning outcomes and connection]
    |
    v
[1.1 What makes a decision organization-scale]
    |
    v
[1.2 Framing: the decision statement]
    |
    v
[1.3 Objectives in service units]
    |
    v
[1.4 Three decision rules]
    |
    v
[1.5 Probabilities you do not know: sensitivity and t]
    |
    v
[1.6 Value of information]
    |
    v
[1.7 Judgement errors that distort security decisions]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes and connection

After this chapter you should be able to:

1. Frame an organization-scale security decision: who decides, by when, among which options, against which objectives.
2. Express objectives in units of the essential service — hours of supply lost, patients diverted, households affected — rather than only in money or control counts.
3. Compare options with expected value, worst case and minimax regret, and explain when each rule is appropriate.
4. Test how sensitive a recommendation is to the probabilities you were least sure of, and state the threshold at which it changes.
5. Estimate the value of further information before buying it.
6. Recognize the judgement errors that most often distort security decisions in essential services.
7. Write a decision record that a successor, auditor or regulator could follow.

This chapter sets the decision habits every later chapter uses. Chapter 4 adds quantified risk and its distribution across people; Chapter 5 applies the same reasoning to architectures; Chapter 9 turns decision records into assurance.

1.1 What makes a decision "organization-scale"

A practitioner at earlier stages chooses settings, tools and procedures. A specialist leading security for an essential service chooses portfolios under constraint: which of several worthwhile programmes to fund this year, which risk to accept, which supplier to keep, when to disconnect a plant from a network. Such decisions share five features. They are irreversible or expensive to reverse — a three-year managed-service contract, a re-architected control network. Their outcomes are uncertain and rare, so experience alone gives poor feedback: a utility may go a decade without the event a control was bought for. They have several objectives that cannot be collapsed honestly into one number: continuity of supply, safety of staff and public, cost, legal compliance, privacy and reputation. They have several stakeholders with legitimate but different interests — the board, operators, the regulator, customers, neighbouring operators. And they are made by someone with authority, who must later explain them.

The specialist's job is rarely to make the decision alone. It is to structure it so the person with authority can decide well, and to make the structure inspectable. That distinction matters for accountability (Chapter 7) and for ethics (Chapter 4): an analyst who quietly chooses the weights has made the decision while appearing only to advise.

1.2 Framing: the decision statement

Most poor security decisions are well analysed answers to badly framed questions. A decision statement fixes six things before any analysis:

Lesson table; scroll horizontally to read all columns →

The "defer" option deserves explicit attention. It is always available, it is what happens when nobody decides, and in essential services it is often worse than it looks because its losses are concentrated in rare, severe scenarios. Writing it down forces the analysis to show its cost.

Good options are genuinely different, not one favoured option with two straw men. A useful test: could a reasonable, informed person prefer each one under some plausible view of the world? If not, the option set is a justification exercise.

1.3 Objectives in service units

The NIST Cybersecurity Framework 2.0 places "Govern" at the centre of security management and asks organizations to understand their mission, stakeholders and risk appetite before choosing controls (NIST, CSF 2.0, 2024). For an essential service, the mission is delivered in service units: litres of compliant water, megawatt-hours delivered, patients treated within clinical time targets, containers moved, payments settled. An objective expressed in service units does three things a monetary objective cannot. It keeps the people who depend on the service visible; it lets operators — who think in service units — check the analysis; and it exposes cases where money and harm diverge, for example when a cheap outage falls on people who cannot cope with it (Chapter 4).

In practice you will use both: service units for consequence and money for cost. Keep them in separate columns until the decision-maker agrees an exchange rate, and record that rate as a judgement, not a fact. The UK National Cyber Security Centre's Cyber Assessment Framework makes a similar move by organizing its objectives around the essential function rather than around IT assets (NCSC, Cyber Assessment Framework).

1.4 Three decision rules

Suppose you have a table of options by scenarios, with the total annual cost (programme cost plus loss) in each cell. Three decision rules read that table differently.

Expected value (EV). Weight each scenario's outcome by its probability and sum. Choose the option with the lowest expected cost. EV is the right rule when you face many similar, independent decisions and can absorb variation, because over many repetitions the average is what you pay. It is the default in insurance and portfolio thinking. Its weaknesses: it depends on probabilities that, for rare cyber-physical events, nobody knows well; and it treats a small chance of catastrophe as interchangeable with a certain small loss.

Minimax (worst case). Choose the option whose worst outcome is least bad. Minimax is appropriate when one outcome would be unacceptable regardless of its probability — loss of life, loss of the organization, loss of public trust in drinking water. Its weakness is that it ignores probabilities entirely and can buy expensive protection against a scenario that is almost impossible.

Minimax regret. For each scenario, find the best option; an option's regret in that scenario is how much worse it is than that best. Choose the option whose largest regret is smallest (Savage, 1951). Regret captures how a decision will look afterwards — "we should have done X" — and tends to favour balanced options when no scenario dominates. Its weakness is that adding or removing an irrelevant option can change the answer.

None of these rules is "correct". A specialist reports what each rule recommends, explains why they differ, and helps the decision-maker choose a rule before seeing which option it favours. When all three agree, the decision is robust. When they disagree, the disagreement is the most useful thing you can show a board.

1.5 Probabilities you do not know: sensitivity and thresholds

Probabilities of rare security scenarios are judgements, not measurements. Three practices keep them honest. First, elicit carefully: ask for ranges, ask several people independently, and ask about base rates before the specific case (O'Hagan et al., 2006). Second, show several belief sets — the analyst's, a pessimist's, the regulator's implied view — rather than one. Third, and most useful, find the threshold: the probability at which the recommendation changes. A board cannot easily say whether the probability of an OT remote-access compromise is 3% or 6% a year, but it can often say whether it is above or below a stated threshold, especially if you show it the evidence behind each view — for example, public advisories describing pre-positioning in infrastructure networks (CISA, AA24-038A, 2024).

1.6 Value of information

Before commissioning an assessment, a penetration test or a consultancy study, ask what it could change. The expected value of perfect information (EVPI) is the difference between the expected cost of the best option now and the expected cost if you could learn which scenario will happen before choosing. It is an upper bound on what any study is worth for this decision: if EVPI is £50k, a £200k study cannot pay for itself through this decision alone. Real studies give imperfect information, so they are worth less than EVPI; if a study cannot plausibly move a probability across the threshold found in §1.5, it is worth little for the decision, however interesting it is. This is standard decision-analysis reasoning; the point for practice is to write down, before buying information, which result would change which choice.

1.7 Judgement errors that distort security decisions

Classic research on judgement under uncertainty describes heuristics — availability, representativeness, anchoring — that lead to systematic errors (Tversky and Kahneman, 1974). In essential-service security they appear in recognizable forms:

• Availability after a headline. A widely reported incident in another sector raises the perceived probability of that scenario and crowds out quieter, more likely ones.
• Anchoring on last year's budget or on a vendor's first quote.
• Compliance substitution. Treating "the regulator requires X" as if it answered "X is the best use of the next pound". Compliance is a constraint (§1.2), not an objective.
• Control counting. Preferring the option that closes most audit findings rather than the one that most reduces consequence.
• Optimism about manual fallback. Assuming operators can run a plant by hand because they once could, without a recent drill (Chapter 6).
• Groupthink and deference. The most senior person speaks first and the rest anchor on them.

Structural remedies work better than exhortation: independent estimates before discussion; a nominated sceptic; a pre-mortem, in which the group imagines the decision has failed and writes down why (Klein, 2007); and a written record of dissent.

1.8 The decision record

A decision record is a short document written at the time of the decision, containing: the decision statement; the options and why each was considered; the evidence used, with sources; the probability and weight judgements and who made them; what each decision rule recommended; the threshold analysis; the choice made, by whom, and on which rule; the residual risk accepted and its owner; dissent; and the review trigger — the observation that would reopen the decision (for example, "a credible advisory reporting compromise of remote-access appliances of the type we use"). The record protects good decision-makers when a rare event happens anyway, and it is how organizations learn: without it, hindsight rewrites what was known.

1.9 Worked example: Merrow Water's programme choice (synthetic)

Merrow Water's envelope allows one of four options for the coming year. The specialist and the operations team built the table below (thousands of pounds per year, including each option's own cost; lower is better). Option A hardens remote access (brokered vendor sessions, phishing-resistant MFA, removal of standing accounts). Option B builds manual-operations capability (procedures, local instrumentation, drills, staffing cover) so plants keep producing safe water when control systems are lost. Option C does half of each. Option D defers.

Lesson table; scroll horizontally to read all columns →

The reasoning behind some cells matters more than the numbers. B performs well whenever control systems are lost (ransomware, outage) because the plant keeps running by hand, but poorly when they are misused by an intruder, because manual capability does not stop malicious commands before they are noticed. A performs well against the intruder but not against loss. D is cheapest in a quiet year and catastrophic in the OT scenario, whose cost includes a boil-water notice affecting the whole Hollin supply zone.

The team recorded three belief sets for the scenario probabilities: the analyst's (15% / 3% / 10% / 72%), a pessimist's (25% / 10% / 15% / 50%) and an implied regulator's view with more weight on OT compromise (10% / 8% / 5% / 77%). Lab 1 computes the results.

1.10 Practical activity: one decision, three rules

Run the lab, then read the interpretation.

# Lab 1 - one decision, three decision rules (offline, standard library only)
# Synthetic: Merrow Water's annual security investment choice. Figures are invented, in GBP thousands per year,
# and already include each option's own annual cost. Lower is better (cost + expected/realized loss).
OPTIONS = ["A remote-access hardening", "B manual-operations capability", "C half of each", "D defer"]
SCEN = ["IT ransomware", "OT remote-access compromise", "vendor/cloud outage", "quiet year"]
COST = {  # option -> loss in each scenario (k GBP)
    "A remote-access hardening":      [ 700,  240,  650, 170],
    "B manual-operations capability": [ 450,  900,  330, 230],
    "C half of each":                 [ 560,  520,  470, 200],
    "D defer":                        [1300, 2600,  780,   0],
}
BELIEFS = {
    "analyst":    [0.15, 0.03, 0.10, 0.72],
    "pessimist":  [0.25, 0.10, 0.15, 0.50],
    "regulator":  [0.10, 0.08, 0.05, 0.77],
}
def ev(o, p): return sum(c * q for c, q in zip(COST[o], p))
for name, p in BELIEFS.items():
    assert abs(sum(p) - 1) < 1e-9
    ranked = sorted(OPTIONS, key=lambda o: ev(o, p))
    print(f"{name:10s}", "  ".join(f"{o[0]}={ev(o, p):7.1f}" for o in OPTIONS), " best:", ranked[0][0])
best_in = [min(COST[o][s] for o in OPTIONS) for s in range(len(SCEN))]
regret = {o: max(COST[o][s] - best_in[s] for s in range(len(SCEN))) for o in OPTIONS}
worst = {o: max(COST[o]) for o in OPTIONS}
print("max regret:", "  ".join(f"{o[0]}={regret[o]}" for o in OPTIONS), " minimax-regret:", min(OPTIONS, key=regret.get)[0])
print("worst case:", "  ".join(f"{o[0]}={worst[o]}" for o in OPTIONS), " minimax:", min(OPTIONS, key=worst.get)[0])
# Robustness: sweep P(OT compromise) from 0 to 0.30, keeping the analyst's other ratios, and report the EV winner.
base = BELIEFS["analyst"]
prev = None
for k in range(0, 31):
    q = k / 100
    rest = [base[0], base[2], base[3]]; s = sum(rest)
    p = [rest[0] / s * (1 - q), q, rest[1] / s * (1 - q), rest[2] / s * (1 - q)]
    win = min(OPTIONS, key=lambda o: ev(o, p))[0]
    if win != prev:
        print(f"P(OT compromise)={q:.2f}: EV winner {win}")
        prev = win

Expected output:

analyst    A=  299.6  B=  293.1  C=  290.6  D=  351.0  best: C
pessimist  A=  381.5  B=  367.0  C=  362.5  D=  702.0  best: C
regulator  A=  252.6  B=  310.6  C=  275.1  D=  377.0  best: A
max regret: A=320  B=660  C=280  D=2360  minimax-regret: C
worst case: A=700  B=900  C=560  D=2600  minimax: C
P(OT compromise)=0.00: EV winner B
P(OT compromise)=0.03: EV winner C
P(OT compromise)=0.07: EV winner A

Interpretation. Under the analyst's and pessimist's beliefs, C has the lowest expected cost, but only narrowly: 290.6 against 293.1 for B and 299.6 for A under the analyst's view. Differences of £3k–£9k on estimates this rough are not a basis for decision on their own. Under the regulator's beliefs A wins. The threshold sweep makes the structure visible: B wins only if the probability of OT compromise is below about 3%; C between about 3% and 7%; A above about 7%. Minimax and minimax regret both choose C, because C never does very badly. C is therefore the robust recommendation: it is best or near-best under every belief set and every rule. The decision record should say exactly that, and add the review trigger: evidence that pushes the probability of OT compromise above 7% (for example, credible reporting of exploitation of the remote-access products Merrow uses) moves the recommendation to A. Note also what the table cannot show: C's value assumes that "half of each" delivers more than half the benefit of each, which is a judgement the operations director must confirm.

1.11 Common errors and limits

• Presenting a single "risk score" per option, which hides whether the score came from frequency, severity or an arbitrary weighting.
• Omitting the defer option, or giving it zero cost.
• Choosing the decision rule after seeing which option it favours.
• Reporting expected values to the pound when the inputs are rough judgements; report differences that matter and thresholds instead.
• Treating precise-looking vendor or survey statistics as probabilities for your organization without asking how they were produced (Chapter 10).
• Letting the analyst's weights silently become the decision.
• Writing the decision record afterwards, when hindsight has already shaped it.

The main limit of formal decision analysis is that it is only as good as the option set and the consequence model. Its value is not that it produces the right answer automatically, but that it makes the reasons for an answer inspectable and revisable when new evidence arrives.

Exercises — chapter 1

EX001 — Frame a hospital decision. Objective: write a decision statement for a real-feeling choice. Inputs: Merrow Health must decide whether to replace its unsupported pathology laboratory system this year or isolate it and replace it in two years. Constraints: use the six elements in §1.2; at least three genuinely different options including defer; objectives in service units. Steps: (1) write the statement; (2) apply the "reasonable person could prefer it" test to each option; (3) list two constraints that are not objectives. Expected evidence: one-page decision statement. Rubric: 3 = all six elements, options genuinely different, service-unit objectives (for example turnaround of urgent results), constraints distinguished from objectives; 2 = one element weak; 1 = options are straw men or objectives only in money; 0 = missing.

EX002 — Change one cell. Objective: see how decision rules respond to a revised consequence estimate. Inputs: Lab 1. Constraints: change only D's cost in the OT scenario from 2,600 to 1,200 (the engineers believe a boil-water notice could be confined to one zone). Steps: (1) rerun; (2) report the EV winner under each belief set, each option's maximum regret and the minimax-regret choice; (3) explain why D still does not win. Expected evidence: outputs and 150-word explanation. Rubric: 3 = correct numbers and an explanation linking D's regret to the ransomware scenario, not only the OT one; 2 = numbers right, explanation thin; 1 = not run; 0 = none.

EX003 — Value of perfect information. Objective: bound what further study is worth. Inputs: Lab 1 table and the analyst's beliefs. Constraints: compute by hand or with a short addition to the lab. Steps: (1) compute the expected cost of the best option now; (2) compute the expected cost if you knew the scenario before choosing; (3) report EVPI; (4) a consultant offers a £60k OT threat assessment — explain under what condition it could be worth buying for this decision. Expected evidence: calculation and paragraph. Rubric: 3 = EVPI correct and the purchase linked to whether the study could move the OT probability across the 3% or 7% thresholds; 2 = EVPI right, link weak; 1 = arithmetic errors; 0 = none.

EX004 — Decision record with dissent. Objective: produce an inspectable record. Inputs: the worked example and Lab 1 output. Constraints: one page; all elements of §1.8. Steps: (1) write the record for choosing C; (2) include a realistic dissent from the operations manager who prefers B; (3) state the review trigger and the residual-risk owner. Expected evidence: decision record. Rubric: 3 = complete, honest about narrow EV margins, dissent stated fairly, measurable trigger; 2 = one element missing; 1 = reads as advocacy; 0 = none.

EX005 — Bias audit. Objective: recognize judgement errors in a meeting. Inputs: synthetic minutes: "The chair opened by noting the recent pipeline ransomware case and said OT security is now the top priority. The vendor's proposal of £400k was taken as the starting point. The operations manager said manual running is 'no problem — we did it in 2009'. The internal audit lead noted that option A closes nine of eleven open findings. No other views were recorded." Constraints: name at most five errors from §1.7 and propose one structural remedy for each. Steps: identify, explain, remedy. Expected evidence: table. Rubric: 3 = availability, anchoring, manual-fallback optimism, control counting and deference/groupthink identified with structural remedies (independent estimates, pre-mortem, drill evidence, consequence-based scoring, recorded dissent); 2 = three or four; 1 = generic advice; 0 = none.

Chapter synthesis

Organization-scale security decisions are irreversible, rare-event, multi-objective and multi-stakeholder, and they belong to someone with authority. The specialist's contribution is structure: a decision statement with genuinely different options including defer, objectives in service units, several decision rules reported side by side, belief sets rather than a single probability, thresholds at which the recommendation changes, the value of further information, structural defences against biased judgement and a decision record written at the time. A robust recommendation is one that survives changes of rule and of belief; when it does not, show the threshold and let the accountable person decide knowingly.