<a id="ch-01"></a>

## Chapter 1 — Advanced security decision-making

### Learning outcomes

You will (1) frame an OT security decision with options, criteria, uncertainty and a decision owner; (2) compare options by expected loss and worst credible case together; (3) record a decision so it can be audited later; and (4) recognise when a decision should be deferred to gather information.

### 1.1 Decisions, not findings

At postgraduate level the deliverable is rarely a vulnerability list; it is a decision someone with budget and accountability must take. At the synthetic Bayside Water Reclamation Plant (BWRP), OT security lead Daniel Osei must decide how vendors reach the chemical-dosing controller PLC-D. A decision frame names the owner (the plant director), the options, the criteria, what is uncertain and the date by which the decision must be taken.

For the vendor-access decision the frame also needs the deadline that forces it, such as the expiry of the current VPN contract, and the people who must be consulted: operations, the vendor manager and engineering. Writing the frame before the analysis keeps Daniel from choosing criteria after he knows which option they favour.

### 1.2 Expected loss is necessary but not sufficient

Expected annual loss — probability times loss, summed over scenarios — lets options with different costs be compared on one scale. But public utilities are not risk-neutral: a rare event that contaminates discharge to a bay, triggers regulatory action and erodes public trust may be unacceptable at any probability above a threshold. Leaders therefore report expected loss alongside the worst credible case and any regulatory or safety constraint that is binding regardless of arithmetic.

```python
"""Lab 01: compare three synthetic BWRP options by expected annual loss and worst credible case."""
options = {  # name: (annual cost, [(probability per year, loss if it happens)])
    "A keep vendor VPN":        (10_000, [(0.10, 400_000), (0.02, 2_500_000)]),
    "B brokered sessions":      (35_000, [(0.03, 400_000), (0.005, 2_500_000)]),
    "C no remote access":       (90_000, [(0.01, 400_000), (0.004, 2_500_000)]),
}
for name, (cost, events) in options.items():
    eal = sum(p * l for p, l in events)
    worst = max(l for _, l in events)
    print(f"{name:20} cost={cost:>7,} expected_loss={eal:>9,.0f} total={cost+eal:>9,.0f} worst_case={worst:,}")
```

Run with `python3 lab_decide.py`. Verified output:

```text
A keep vendor VPN    cost= 10,000 expected_loss=   90,000 total=  100,000 worst_case=2,500,000
B brokered sessions  cost= 35,000 expected_loss=   24,500 total=   59,500 worst_case=2,500,000
C no remote access   cost= 90,000 expected_loss=   14,000 total=  104,000 worst_case=2,500,000
```

### 1.3 Reading the comparison

Option B has the lowest total (59,500) because its control cost buys a large reduction in incident probability. Option C eliminates more risk but costs more than it saves under these estimates. All three share the same worst case because the catastrophic scenario remains possible through other paths; no remote-access choice removes it. That observation sends the leader to look at independent safeguards, not more remote-access spending.

The numbers also show how sensitive the ranking is. Option A loses because of its incident probabilities; if both of its estimates were halved, A's total would fall to 55,000 and overtake B's 59,500. That is why Daniel's record names a revisit trigger tied to the incident estimate, and why the next question is how firm those probabilities really are.

### 1.4 Value of information

If the probability estimates are contested — and for targeted attacks they always are — ask whether the decision would change if they moved within their plausible range. If B wins across that range, decide now. If the ranking flips, a short study (vendor log review, a tabletop) may be worth more than an immediate purchase.

For BWRP, the question is whether B still wins if Option A's vendor-incident probability is lower than estimated. Daniel can test that in the lab by changing one number at a time and noting where the ranking flips. If a flip needs an estimate outside what sector peers report, the decision stands; if not, two weeks reviewing vendor logs may be the better first spend.

### Worked example (synthetic BWRP)

Daniel's decision record: "D-2026-14. Owner: plant director. Decision: adopt brokered vendor sessions (B). Basis: lowest total expected cost under estimates in annex 1; same worst case across options, so a separate action (D-2026-15) reviews the dosing high-limit interlock. Revisit if vendor incident frequency estimate exceeds 0.06 per year or after any remote-access incident."

> **Synthetic case — Bayside Water Reclamation Plant.** BWRP, Daniel Osei, all costs and probabilities are invented.

### Errors and limits

Point estimates for adversarial probabilities convey false precision; present ranges. Expected-loss arithmetic does not capture harm to people downstream, which must be argued separately.

### Exercises

- **EX001 — Total cost for option A at a lower probability.** If A's 400,000 scenario falls to 0.05 per year, recompute A's total. *Rubric:* 3 = 10,000 + 20,000 + 50,000 = 80,000, still above B; 2 = number only; 1 = arithmetic slip; 0 = none.
- **EX002 — Why the worst case is identical.** Explain what the shared 2.5 million worst case implies for the leader. *Rubric:* 3 = remote-access choice does not remove catastrophic path; invest in independent safeguard; 2 = partial; 1 = "all equal"; 0 = none.
- **EX003 — Writing a revisit trigger.** Add one more revisit trigger to D-2026-14. *Rubric:* 3 = observable, specific trigger; 2 = vague but relevant; 1 = "if things change"; 0 = none.
- **EX004 — Does the ranking flip?** Find the probability for B's 400,000 scenario at which B's total equals A's 100,000. *Rubric:* 3 = (100,000 − 35,000 − 12,500)/400,000 ≈ 0.131; 2 = method; 1 = ignores other term; 0 = none.
- **EX005 — When not to decide yet.** Describe a situation in which Daniel should defer D-2026-14 to gather information. *Rubric:* 3 = ranking flips within plausible range and a cheap study can narrow it before a deadline; 2 = partial; 1 = "when unsure"; 0 = none.

### Synthesis

Leaders decide with expected loss, worst credible case, explicit owners and revisit triggers, and they buy information when it could change the choice.

### Continue studying — chapter 01 of 12

[← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02)

## Worked answers

<a id="answer-ex001"></a>
**EX001.** 10,000 + 0.05 × 400,000 + 0.02 × 2,500,000 = 10,000 + 20,000 + 50,000 = 80,000 — still higher than B's 59,500.

<a id="answer-ex002"></a>
**EX002.** The catastrophic scenario can occur through paths that no remote-access option closes, so further spending on remote access cannot lower the worst case; the leader should fund an independent safeguard (for example a hardwired dosing high-limit) to change the tail.

<a id="answer-ex003"></a>
**EX003.** "Revisit if the broker vendor reports a security incident affecting its session service, or if the broker's attestation report is more than 12 months old."

<a id="answer-ex004"></a>
**EX004.** B total = 35,000 + 400,000p + 0.005 × 2,500,000 = 47,500 + 400,000p. Setting it to 100,000 gives p = 52,500 / 400,000 ≈ 0.131 per year.

<a id="answer-ex005"></a>
**EX005.** If credible estimates of A's incident probability range from 0.01 to 0.10 and the ranking between A and B flips inside that range, while a two-week review of vendor access logs could narrow the estimate before the contract deadline, deferring for the study is better than deciding now.