Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Decision objects"]
N2["1.2 Uncertainty types"]
N3["1.3 Acceptance vs deferral"]
N4["1.4 Examiner readability"]
N5["1.5 Authority"]
N6["1.6 Practice"]
N7["1.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Decision objects"]
N2["1.2 Uncertainty types"]
N3["1.3 Acceptance vs deferral"]
N4["1.4 Examiner readability"]
N5["1.5 Authority"]
N6["1.6 Practice"]
N7["1.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Decision objects]
|
v
[1.2 Uncertainty types]
|
v
[1.3 Acceptance vs deferral]
|
v
[1.4 Examiner readability]
|
v
[1.5 Authority]
|
v
[1.6 Practice]
|
v
[1.7 Narrative]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) structure decisions under uncertainty for authorized testing programmes; (2) separate risk acceptance from wishful thinking; (3) use decision records that examiners can follow; (4) refuse decisions that lack an owner.
1.1 Decision objects
At Meridian Clearing House, Amira Hassan treats each major testing choice as an object with options, evidence, uncertainties, recommendation and owner. "We should red team more" is not a decision object until options and trade-offs are written.
DEC-14 rejects annual threat-led work because white-team capacity cannot cover two full cycles without borrowing SOC analysts from BAU. The CISO accepts that capacity limit in writing, and Amira files the acceptance beside the options table so a later examiner sees the trade-off was owned, not implied.
Until those five fields are written, a slogan such as we should red team more is not a decision object, and examiners cannot see what was traded away. Amira opens a blank object on the projector whenever a VP asks for a quick yes, so ownership is forced into the open before scope expands.
1.2 Uncertainty types
She distinguishes aleatory uncertainty (noisy detection rates) from epistemic uncertainty (unknown whether a conduit exists). Wilson-style intervals help the first; architecture workshops help the second. Mixing them produces false precision.
For DEC-14 she marks detection-rate noise as aleatory and the unknown SWIFT-adjacent conduit as epistemic. The architecture workshop that follows has a date and a named lead; inventing a percentage for the conduit would have produced false precision the board would have treated as fact.
Her decision records label which uncertainties are which, so a later reader knows what more data could fix and what only design work can fix. Mixing noisy detection rates with unknown conduits is how board packs gain a single percentage that pretends certainty.
1.3 Acceptance vs deferral
Accepting residual risk requires a named acceptor, expiry and compensating control. Deferring a test because "next year is better" without a date is neither acceptance nor management — it is drift.
The SWIFT-adjacent exclusion names the CISO as acceptor, expires at the next catalogue review, and lists network isolation plus jump-host MFA as compensating controls. Amira will not file acceptance if any of those three fields is blank, and she will not treat an open-ended deferral as a substitute for them.
Saying next year without a date would leave the SWIFT-adjacent exclusion as drift. Examiners reading the record should see a deliberate choice with acceptor, expiry and compensating controls, not a postponed conversation dressed as management.
1.4 Examiner readability
Decision records answer: what was chosen, what was rejected, what evidence counted, what remains unknown. Amira rejects records that read like slogans.
A readable DEC-14 record states that quarterly WSTG-style web tests plus a biennial threat-led exercise were chosen, that annual threat-led was rejected for capacity, and that SWIFT-adjacent systems remain excluded. A director who missed the meeting can reconstruct the trade-off without calling Amira.
Slogans such as we take security seriously are deleted from drafts before they leave her desk. She writes so a successor can continue without asking her for folklore, and so a director who was not in the room can reconstruct capacity limits on annual threat-led work.
1.5 Authority
Only roles listed in the governance charter may accept payment-adjacent residual risk. Amira escalates rather than inventing authority.
Payment-adjacent residual risk sits with roles named in the governance charter: the CISO for ordinary exclusions, the board risk committee for programme-wide choices. When a product owner asks Amira to accept what she cannot, she escalates with the charter excerpt attached rather than inventing authority.
Invented authority collapses under examiner challenge, so she keeps the charter excerpt beside every acceptance record. Product owners who want her signature on what only the CISO may accept receive an escalation, not a quiet nod.
1.6 Practice
Weekly decision clinic: one real (synthetic) choice, twenty minutes, written record before leaving the room.
The weekly clinic takes one synthetic choice — for example, slipping the threat-led exercise by a quarter — and ends with options, evidence and owner written before anyone leaves. Amira logs the record the same day so the clinic cannot become an undocumented hallway chat.
Juniors present first in the clinic; she edits for clarity, not for softer conclusions. Twenty minutes is enough when the choice is real and synthetic, such as whether to slip a threat-led exercise, and the written record lands in the decision log the same day.
1.7 Narrative
Amira keeps DEC records in a folder that internal audit sampled last year without finding undated deferrals. The sample letter is pinned above her monitor. When a VP asks for a quick yes on expanding scope into participant networks, she opens a blank decision object on the projector and fills options aloud until the VP either commits ownership or withdraws. The ritual feels slow and prevents silent scope inflation across clearing participants. Three deputies have now authored DEC records audit accepted unchanged.
Internal audit sampled the DEC folder last year and found no undated deferrals; the sample letter stays pinned above her monitor. When a VP wants a quick yes on participant-network scope, she fills a blank decision object on the projector until ownership is accepted or the request is withdrawn.
Worked example (synthetic MCH)
Amira's record DEC-14 chooses quarterly WSTG-style web tests plus a biennial threat-led exercise; rejects annual threat-led for capacity reasons; lists SWIFT-adjacent systems as out of ordinary scope with CISO as acceptor of that exclusion.
Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.
Errors and limits
Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.
Exercises
- EX001 — Decision object fields. List five fields of a decision object. Rubric: 3 = five of options, evidence, uncertainties, recommendation, owner, rejects; 2 = three; 1 = one; 0 = none.
- EX002 — Aleatory vs epistemic. Give one example of each at MCH. Rubric: 3 = both correct types; 2 = one; 1 = swapped; 0 = none.
- EX003 — Bad deferral. Why is "test next year" without a date a problem? Rubric: 3 = drift / neither accept nor manage; 2 = partial; 1 = fine; 0 = none.
- EX004 — Authority. Who may accept payment-adjacent residual risk? Rubric: 3 = roles in governance charter / CISO-level; 2 = partial; 1 = any engineer; 0 = none.
- EX005 — DEC-14 rejects. What does DEC-14 reject and why? Rubric: 3 = annual threat-led for capacity; 2 = partial; 1 = all testing; 0 = none.
Synthesis
Decisions are owned objects with uncertainties named; slogans and undated deferrals do not count.