Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The decision setting"]
N2["1.2 Facts, estimates and values"]
N3["1.3 Options and consequences"]
N4["1.4 Reversibility and staging"]
N5["1.5 Recording decisions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The decision setting"]
N2["1.2 Facts, estimates and values"]
N3["1.3 Options and consequences"]
N4["1.4 Reversibility and staging"]
N5["1.5 Recording decisions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The decision setting]
|
v
[1.2 Facts, estimates and values]
|
v
[1.3 Options and consequences]
|
v
[1.4 Reversibility and staging]
|
v
[1.5 Recording decisions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame security decisions under uncertainty; (2) separate facts, estimates and values; (3) record decisions for review.
1.1 The decision setting
Marta Lindqvist joins the two-year postgraduate specialist programme at the fictional Kestrel Graduate School after six years as a network engineer. Her placement partner is the fictional Fenwick Valley Broadband, a community internet provider with five points of presence, about nine thousand customers and a small network operations team. The provider faces three pressing questions: whether to replace ageing site-to-site VPNs, whether to adopt route origin validation, and how strictly to filter spoofed traffic from customers. Each choice affects customers, partners and staff, and none has a single obviously right answer.
1.2 Facts, estimates and values
Prof. Aiyana Brooks, her supervisor, asks Marta to separate three kinds of input in every decision. Facts can be checked, such as the number of VPN peers still using IKEv1. Estimates carry uncertainty, such as the chance that a misconfigured customer router leaks spoofed traffic in a given year. Values are judgements about what matters, such as how much disruption to customers is acceptable to gain protection. Mixing them causes poor arguments: people argue about values while appearing to argue about facts, and estimates are presented with false precision that hides genuine uncertainty.
1.3 Options and consequences
For each decision Marta lists realistic options, including doing nothing, and describes consequences under different conditions. For route origin validation, the options are to ignore validation results, to mark invalid routes with lower preference, or to reject invalid routes outright. Rejecting gives the strongest protection against mis-originated routes but could drop legitimate routes if a partner's records are wrong. Describing consequences per option, rather than arguing for a favourite, keeps the analysis honest and makes trade-offs visible to the provider's directors, who will make the final decision.
1.4 Reversibility and staging
A decision that can be reversed cheaply can be taken with less certainty than one that cannot. Marta notes that most network policy changes are reversible within minutes, while contractual commitments with partners are not. This suggests staging: begin with monitoring or soft enforcement, measure effects, then tighten. Staging turns a single risky choice into several smaller ones, each informed by evidence from the last. It also gives customers and partners time to fix their own configurations before enforcement affects them, which preserves goodwill in a small regional market.
1.5 Recording decisions
Marta keeps a decision record for each choice: the question, options, evidence, estimates with ranges, the values applied, the decision, who made it and when it should be revisited. Records protect against hindsight bias, where people later judge a reasonable decision as foolish because of an outcome nobody could have foreseen. They also help new staff understand why the network is configured as it is. At Fenwick Valley, previous decisions were rarely written down, so Marta's first records reconstruct the reasons for existing settings from interviews with the operations team.
Worked example
Marta's first decision record, on route origin validation, lists three options, separates two facts, two estimates and one value judgement, and recommends staged enforcement.
Synthetic case. The provider and data are synthetic.
Errors and limits
Presenting estimates as facts gives decision makers false confidence.
Exercises
- EX001 — Input classification. Classify "three peers use IKEv1" and "a leak is unlikely this year". Rubric: 3 = first is fact, second estimate, explained;; 2 = both classified;; 1 = one correct;; 0 = none.
- EX002 — Do-nothing option. Why include doing nothing as an option? Rubric: 3 = baseline for comparing consequences;; 2 = comparison;; 1 = unnecessary;; 0 = none.
- EX003 — Staging benefit. Give two benefits of staging enforcement. Rubric: 3 = evidence between steps, time for others to fix configurations;; 2 = two;; 1 = one;; 0 = none.
- EX004 — Hindsight protection. How does a decision record protect against hindsight bias? Rubric: 3 = shows what was known and reasoned at the time;; 2 = context;; 1 = vague;; 0 = none.
- EX005 — Reversibility judgement. Which is less reversible: a filter change or a partner contract term? Rubric: 3 = contract term; filters revert in minutes;; 2 = contract;; 1 = filter;; 0 = none.
Synthesis
Good security decisions separate facts, estimates and values, prefer staged reversible steps and are recorded for review.