## Chapter 1 — Advanced security decision-making ### Lesson map Lesson 01 published. Map, example, EX001. ```mermaid flowchart TD N0["Learning outcomes"] N1["1.1 The case"] N2["1.2 Facts, assumptions and values"] N3["1.3 Decision rules"] N4["1.4 Writing the decision record"] N5["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 --> N5 N5 --> EX["Worked example"] EX --> Q["Exercise EX001"] ``` ### Logical drawing ```mermaid flowchart LR N0["Learning outcomes"] N1["1.1 The case"] N2["1.2 Facts, assumptions and values"] N3["1.3 Decision rules"] N4["1.4 Writing the decision record"] N5["Synthesis"] N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"] ``` ```text [Learning outcomes] | v [1.1 The case] | v [1.2 Facts, assumptions and values] | v [1.3 Decision rules] | v [1.4 Writing the decision record] | v [Synthesis] | v [Worked example] --> [Exercise EX001] ``` ### Learning outcomes You will (1) frame an organisation-scale cryptographic decision; (2) separate facts, assumptions and values in a decision record; (3) choose decision rules that survive scrutiny by executives and auditors. ### 1.1 The case Leila Moradi is a security architect at the fictional Corvane Logistics, a shipping and freight company with port terminals, a truck fleet, a finance division and an ageing electronic data interchange platform. She studies part-time in the postgraduate programme at the fictional Westbrook School of Security under Prof. Anika Rao. Corvane's board has asked for a plan to modernise cryptography across the company within two years: retire legacy TLS, consolidate key management and prepare for post-quantum migration. Every system, figure and person in this book is synthetic. The decision is not which cipher is strongest but how to spend limited money and engineering time across many systems. ### 1.2 Facts, assumptions and values Prof. Rao asks students to split every decision into three columns. Facts are verifiable, such as the number of endpoints still accepting TLS 1.0 or the date a supplier contract ends. Assumptions are beliefs that could be wrong, such as how quickly large quantum computers will arrive or how long a migration will take. Values are preferences the organisation must own, such as how much outage risk it tolerates during a change. Leila finds that her first draft mixed all three, presenting an assumption about quantum timelines as if it were fact. Separating them lets executives debate values openly and lets engineers test assumptions. ### 1.3 Decision rules Leila compares decision rules. Minimising the worst case suits catastrophic, irreversible risks such as losing the firmware root key. Maximising expected value suits frequent, measurable risks such as certificate expiry. Satisficing, accepting the first option that meets every requirement, suits decisions where analysis costs more than small improvements. She chooses rules per decision, documents why and records what new evidence would change the choice. Katz and Lindell's emphasis on explicit threat models carries over to management: a decision without stated assumptions cannot be evaluated later, and auditors will ask what Corvane believed when it chose. ### 1.4 Writing the decision record Leila drafts the programme's first decision record, adopting a company-wide TLS baseline. It states the decision, the facts (inventory counts), the assumptions (that most clients support TLS 1.2), the values (acceptable disruption for legacy partners), alternatives considered, the rule used (satisficing against a published baseline) and review triggers. She links each claim to its source, including RFC 8446 for TLS 1.3 behaviour and NIST SP 800-52 Rev. 2, the TLS guideline referenced in Corvane's policy. Prof. Rao marks the record strong because a newcomer could reconstruct the reasoning in five minutes without asking Leila. ### Worked example Leila separates facts, assumptions and values for the modernisation programme, picks satisficing for the TLS baseline and minimax for root keys, and writes a decision record with review triggers. > **Synthetic case.** Corvane, Westbrook and all figures are invented; RFC 8446 is real. ### Errors and limits Decision frameworks cannot replace judgement; they make judgement visible. Assumptions presented as facts are the most common flaw in security business cases. ### Exercises - **EX001 — Programme scope.** What three goals did Corvane's board set for the programme? *Rubric:* 3 = retire legacy TLS, consolidate key management, prepare post-quantum migration;; 2 = two;; 1 = one;; 0 = none. - **EX002 — Three columns.** Distinguish a fact, an assumption and a value with Corvane examples. *Rubric:* 3 = fact: endpoints on TLS 1.0; assumption: quantum timeline; value: tolerated outage risk;; 2 = two correct;; 1 = confused;; 0 = none. - **EX003 — Matching rules.** Which decision rule suits root-key loss and which suits certificate expiry? *Rubric:* 3 = minimax for catastrophic root loss; expected value for frequent expiry;; 2 = one;; 1 = reversed;; 0 = none. - **EX004 — Draft flaw.** What flaw did Leila find in her first draft? *Rubric:* 3 = an assumption about quantum timelines presented as fact;; 2 = mixing;; 1 = vague;; 0 = none. - **EX005 — Record test.** Why did Prof. Rao rate the record strong? *Rubric:* 3 = a newcomer could reconstruct the reasoning in five minutes;; 2 = clarity;; 1 = length;; 0 = none. ### Synthesis Organisation-scale cryptographic decisions improve when facts, assumptions and values are separated and each decision uses an explicit, recorded rule. ### Continue studying — chapter 01 of 12 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Retire legacy TLS, consolidate key management and prepare for post-quantum migration within two years. **EX002.** A fact is the count of TLS 1.0 endpoints, an assumption is the quantum-computer timeline, and a value is how much outage risk Corvane accepts. **EX003.** Worst-case minimisation for the catastrophic root-key loss, expected value for frequent, measurable expiries. **EX004.** She had presented an assumption about quantum timelines as an established fact. **EX005.** Because someone new could rebuild the reasoning from it in about five minutes without asking Leila.