Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Decisions, not findings"]
N2["1.2 Expected loss is necessary but not sufficient"]
N3["1.3 Reading the comparison"]
N4["1.4 Value of information"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Decisions, not findings"]
N2["1.2 Expected loss is necessary but not sufficient"]
N3["1.3 Reading the comparison"]
N4["1.4 Value of information"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Decisions, not findings]
|
v
[1.2 Expected loss is necessary but not sufficient]
|
v
[1.3 Reading the comparison]
|
v
[1.4 Value of information]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame an OT security decision with options, criteria, uncertainty and a decision owner; (2) compare options by expected loss and worst credible case together; (3) record a decision so it can be audited later; and (4) recognise when a decision should be deferred to gather information.
1.1 Decisions, not findings
At postgraduate level the deliverable is rarely a vulnerability list; it is a decision someone with budget and accountability must take. At the synthetic Bayside Water Reclamation Plant (BWRP), OT security lead Daniel Osei must decide how vendors reach the chemical-dosing controller PLC-D. A decision frame names the owner (the plant director), the options, the criteria, what is uncertain and the date by which the decision must be taken.
For the vendor-access decision the frame also needs the deadline that forces it, such as the expiry of the current VPN contract, and the people who must be consulted: operations, the vendor manager and engineering. Writing the frame before the analysis keeps Daniel from choosing criteria after he knows which option they favour.
1.2 Expected loss is necessary but not sufficient
Expected annual loss — probability times loss, summed over scenarios — lets options with different costs be compared on one scale. But public utilities are not risk-neutral: a rare event that contaminates discharge to a bay, triggers regulatory action and erodes public trust may be unacceptable at any probability above a threshold. Leaders therefore report expected loss alongside the worst credible case and any regulatory or safety constraint that is binding regardless of arithmetic.
"""Lab 01: compare three synthetic BWRP options by expected annual loss and worst credible case."""
options = { # name: (annual cost, [(probability per year, loss if it happens)])
"A keep vendor VPN": (10_000, [(0.10, 400_000), (0.02, 2_500_000)]),
"B brokered sessions": (35_000, [(0.03, 400_000), (0.005, 2_500_000)]),
"C no remote access": (90_000, [(0.01, 400_000), (0.004, 2_500_000)]),
}
for name, (cost, events) in options.items():
eal = sum(p * l for p, l in events)
worst = max(l for _, l in events)
print(f"{name:20} cost={cost:>7,} expected_loss={eal:>9,.0f} total={cost+eal:>9,.0f} worst_case={worst:,}")
Run with python3 lab_decide.py. Verified output:
A keep vendor VPN cost= 10,000 expected_loss= 90,000 total= 100,000 worst_case=2,500,000
B brokered sessions cost= 35,000 expected_loss= 24,500 total= 59,500 worst_case=2,500,000
C no remote access cost= 90,000 expected_loss= 14,000 total= 104,000 worst_case=2,500,000
1.3 Reading the comparison
Option B has the lowest total (59,500) because its control cost buys a large reduction in incident probability. Option C eliminates more risk but costs more than it saves under these estimates. All three share the same worst case because the catastrophic scenario remains possible through other paths; no remote-access choice removes it. That observation sends the leader to look at independent safeguards, not more remote-access spending.
The numbers also show how sensitive the ranking is. Option A loses because of its incident probabilities; if both of its estimates were halved, A's total would fall to 55,000 and overtake B's 59,500. That is why Daniel's record names a revisit trigger tied to the incident estimate, and why the next question is how firm those probabilities really are.
1.4 Value of information
If the probability estimates are contested — and for targeted attacks they always are — ask whether the decision would change if they moved within their plausible range. If B wins across that range, decide now. If the ranking flips, a short study (vendor log review, a tabletop) may be worth more than an immediate purchase.
For BWRP, the question is whether B still wins if Option A's vendor-incident probability is lower than estimated. Daniel can test that in the lab by changing one number at a time and noting where the ranking flips. If a flip needs an estimate outside what sector peers report, the decision stands; if not, two weeks reviewing vendor logs may be the better first spend.
Worked example (synthetic BWRP)
Daniel's decision record: "D-2026-14. Owner: plant director. Decision: adopt brokered vendor sessions (B). Basis: lowest total expected cost under estimates in annex 1; same worst case across options, so a separate action (D-2026-15) reviews the dosing high-limit interlock. Revisit if vendor incident frequency estimate exceeds 0.06 per year or after any remote-access incident."
Synthetic case — Bayside Water Reclamation Plant. BWRP, Daniel Osei, all costs and probabilities are invented.
Errors and limits
Point estimates for adversarial probabilities convey false precision; present ranges. Expected-loss arithmetic does not capture harm to people downstream, which must be argued separately.
Exercises
- EX001 — Total cost for option A at a lower probability. If A's 400,000 scenario falls to 0.05 per year, recompute A's total. Rubric: 3 = 10,000 + 20,000 + 50,000 = 80,000, still above B; 2 = number only; 1 = arithmetic slip; 0 = none.
- EX002 — Why the worst case is identical. Explain what the shared 2.5 million worst case implies for the leader. Rubric: 3 = remote-access choice does not remove catastrophic path; invest in independent safeguard; 2 = partial; 1 = "all equal"; 0 = none.
- EX003 — Writing a revisit trigger. Add one more revisit trigger to D-2026-14. Rubric: 3 = observable, specific trigger; 2 = vague but relevant; 1 = "if things change"; 0 = none.
- EX004 — Does the ranking flip? Find the probability for B's 400,000 scenario at which B's total equals A's 100,000. Rubric: 3 = (100,000 − 35,000 − 12,500)/400,000 ≈ 0.131; 2 = method; 1 = ignores other term; 0 = none.
- EX005 — When not to decide yet. Describe a situation in which Daniel should defer D-2026-14 to gather information. Rubric: 3 = ranking flips within plausible range and a cheap study can narrow it before a deadline; 2 = partial; 1 = "when unsure"; 0 = none.
Synthesis
Leaders decide with expected loss, worst credible case, explicit owners and revisit triggers, and they buy information when it could change the choice.