Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Decisions under uncertainty"]
N3["1.3 Weighing risk, cost and disruption"]
N4["1.4 Recording the reasoning"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case"]
N2["1.2 Decisions under uncertainty"]
N3["1.3 Weighing risk, cost and disruption"]
N4["1.4 Recording the reasoning"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case]
|
v
[1.2 Decisions under uncertainty]
|
v
[1.3 Weighing risk, cost and disruption]
|
v
[1.4 Recording the reasoning]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame a privileged access decision for senior leaders; (2) weigh risk, cost and disruption; (3) document decisions with their reasoning.
1.1 The case
Marta Kowalczyk is a postgraduate student at the fictional Ashdown Graduate School, supervised by Prof. Leila Haddad. She also works part-time as an infrastructure engineer at the fictional Corran Logistics, a distribution company with 600 staff and three warehouses. Corran has eight administrator accounts with permanent, full rights to its cloud directory, servers and warehouse systems; two are shared by the night shift. An insurer's questionnaire asked how privileged access is controlled, and nobody could answer well. Marta's postgraduate project asks how Corran should manage privileged access, and whether the chosen approach actually reduces risk without slowing operations.
1.2 Decisions under uncertainty
Senior leaders rarely have complete information. Marta frames the decision as a choice among options, each with uncertain benefits and costs. She lists what is known, such as the number of administrators and how often they need full rights, and what is uncertain, such as how likely an administrator account is to be compromised. Instead of pretending to precision, she uses ranges and scenarios: what happens if a shared night-shift account is misused, and how quickly would anyone notice? This framing helps leaders see the decision clearly without a false sense of certainty.
1.3 Weighing risk, cost and disruption
Every option has three faces. Risk reduction is the security benefit. Cost includes licences, staff time and training. Disruption is the effect on operations, such as a warehouse system update delayed because an administrator must request access first. Marta agrees with Corran's operations director that disruption matters as much as cost, because a missed delivery window has real financial and reputational consequences. Stating these weights openly lets leaders see the trade-offs they are making, and prevents security work from being judged on security benefit alone.
1.4 Recording the reasoning
Marta keeps a decision record for each significant choice: the question, options, criteria, evidence, decision, who made it and what would trigger a review. NIST SP 800-53 Rev. 5 includes controls for privileged accounts within its access control family, which she cites when explaining why the decision matters, but the record focuses on Corran's own reasoning. Months later, when an auditor or new director asks why Corran chose a particular approach, the record answers with evidence rather than recollection, and shows that the decision was made deliberately rather than by default.
Worked example
Marta frames the privileged access decision with three options, three weighted faces and a decision record template agreed with the operations director.
Synthetic case. Marta Kowalczyk, Ashdown Graduate School, Corran Logistics and all figures are synthetic; NIST SP 800-53 Rev. 5 is a real source.
Errors and limits
Presenting a security decision with false precision hides uncertainty that leaders need to understand.
Exercises
- EX001 — Corran admins. How many administrator accounts does Corran have, and how many are shared? Rubric: 3 = eight, two shared by night shift;; 2 = eight;; 1 = two;; 0 = none.
- EX002 — Uncertainty handling. How does Marta handle uncertain likelihoods? Rubric: 3 = ranges and scenarios, not false precision;; 2 = scenarios;; 1 = exact numbers;; 0 = none.
- EX003 — Three faces. What are the three faces of every option? Rubric: 3 = risk reduction, cost, disruption;; 2 = two;; 1 = one;; 0 = none.
- EX004 — Disruption example. Give an example of disruption from privileged access controls. Rubric: 3 = warehouse update delayed by an access request;; 2 = delay;; 1 = vague;; 0 = none.
- EX005 — Decision record fields. Name four fields in Marta's decision record. Rubric: 3 = question, options, criteria, evidence, decision, owner, review trigger (four);; 2 = three;; 1 = one;; 0 = none.
Synthesis
Good security decisions name options, weigh risk, cost and disruption openly and record their reasoning.