OpenCyber AcademyLesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Facts, assumptions and values"]
N3["1.3 Decision rules"]
N4["1.4 Writing the decision record"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Facts, assumptions and values"]
N3["1.3 Decision rules"]
N4["1.4 Writing the decision record"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Facts, assumptions and values]
|
v
[1.3 Decision rules]
|
v
[1.4 Writing the decision record]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame an organisation-scale cryptographic decision; (2) separate facts, assumptions and values in a decision record; (3) choose decision rules that survive scrutiny by executives and auditors.
1.1 The case
Leila Moradi is a security architect at the fictional Corvane Logistics, a shipping and freight company with port terminals, a truck fleet, a finance division and an ageing electronic data interchange platform. She studies part-time in the postgraduate programme at the fictional Westbrook School of Security under Prof. Anika Rao. Corvane's board has asked for a plan to modernise cryptography across the company within two years: retire legacy TLS, consolidate key management and prepare for post-quantum migration. Every system, figure and person in this book is synthetic. The decision is not which cipher is strongest but how to spend limited money and engineering time across many systems.
1.2 Facts, assumptions and values
Prof. Rao asks students to split every decision into three columns. Facts are verifiable, such as the number of endpoints still accepting TLS 1.0 or the date a supplier contract ends. Assumptions are beliefs that could be wrong, such as how quickly large quantum computers will arrive or how long a migration will take. Values are preferences the organisation must own, such as how much outage risk it tolerates during a change. Leila finds that her first draft mixed all three, presenting an assumption about quantum timelines as if it were fact. Separating them lets executives debate values openly and lets engineers test assumptions.
1.3 Decision rules
Leila compares decision rules. Minimising the worst case suits catastrophic, irreversible risks such as losing the firmware root key. Maximising expected value suits frequent, measurable risks such as certificate expiry. Satisficing, accepting the first option that meets every requirement, suits decisions where analysis costs more than small improvements. She chooses rules per decision, documents why and records what new evidence would change the choice. Katz and Lindell's emphasis on explicit threat models carries over to management: a decision without stated assumptions cannot be evaluated later, and auditors will ask what Corvane believed when it chose.
1.4 Writing the decision record
Leila drafts the programme's first decision record, adopting a company-wide TLS baseline. It states the decision, the facts (inventory counts), the assumptions (that most clients support TLS 1.2), the values (acceptable disruption for legacy partners), alternatives considered, the rule used (satisficing against a published baseline) and review triggers. She links each claim to its source, including RFC 8446 for TLS 1.3 behaviour and NIST SP 800-52 Rev. 2, the TLS guideline referenced in Corvane's policy. Prof. Rao marks the record strong because a newcomer could reconstruct the reasoning in five minutes without asking Leila.
Worked example
Leila separates facts, assumptions and values for the modernisation programme, picks satisficing for the TLS baseline and minimax for root keys, and writes a decision record with review triggers.
Synthetic case. Corvane, Westbrook and all figures are invented; RFC 8446 is real.
Errors and limits
Decision frameworks cannot replace judgement; they make judgement visible. Assumptions presented as facts are the most common flaw in security business cases.
Exercises
- EX001 — Programme scope. What three goals did Corvane's board set for the programme?
Show marking criteria
Rubric: 3 = retire legacy TLS, consolidate key management, prepare post-quantum migration;; 2 = two;; 1 = one;; 0 = none. - EX002 — Three columns. Distinguish a fact, an assumption and a value with Corvane examples.
Show marking criteria
Rubric: 3 = fact: endpoints on TLS 1.0; assumption: quantum timeline; value: tolerated outage risk;; 2 = two correct;; 1 = confused;; 0 = none. - EX003 — Matching rules. Which decision rule suits root-key loss and which suits certificate expiry?
Show marking criteria
Rubric: 3 = minimax for catastrophic root loss; expected value for frequent expiry;; 2 = one;; 1 = reversed;; 0 = none. - EX004 — Draft flaw. What flaw did Leila find in her first draft?
Show marking criteria
Rubric: 3 = an assumption about quantum timelines presented as fact;; 2 = mixing;; 1 = vague;; 0 = none. - EX005 — Record test. Why did Prof. Rao rate the record strong?
Show marking criteria
Rubric: 3 = a newcomer could reconstruct the reasoning in five minutes;; 2 = clarity;; 1 = length;; 0 = none.
Synthesis
Organisation-scale cryptographic decisions improve when facts, assumptions and values are separated and each decision uses an explicit, recorded rule.