◇ OpenCyber Academy
Postgraduate · Chapter 4 · English

Chapter 4 — Advanced risk and ethics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Advanced risk and ethics

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Distributions over point estimates"]
  N2["4.2 Reading the tail"]
  N3["4.3 Who bears the risk"]
  N4["4.4 Transparency versus exposure"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Distributions over point estimates"]
  N2["4.2 Reading the tail"]
  N3["4.3 Who bears the risk"]
  N4["4.4 Transparency versus exposure"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Distributions over point estimates]
    |
    v
[4.2 Reading the tail]
    |
    v
[4.3 Who bears the risk]
    |
    v
[4.4 Transparency versus exposure]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) model loss distributions rather than single numbers; (2) read mean, 95th and 99th percentile losses from a seeded simulation; (3) decide who bears residual risk and whether they consented; and (4) handle ethical tension between transparency and security in a public utility.

4.1 Distributions over point estimates

Annual OT outage loss is mostly zero and occasionally large. A Monte Carlo simulation draws whether an incident happens and how long it lasts, many thousands of times, producing a distribution whose tail is what boards and insurers care about.

"""Lab 04: Monte Carlo of annual outage loss for BWRP with and without a control (seeded, synthetic)."""
import random, statistics
def year(rnd, p_incident, hours_lo, hours_hi, cost_per_hour=12_000):
    if rnd.random() >= p_incident: return 0.0
    return rnd.uniform(hours_lo, hours_hi) * cost_per_hour
for label, p, lo, hi in [("baseline", 0.15, 4, 72), ("with segmentation", 0.06, 4, 48)]:
    rnd = random.Random(2026)
    losses = sorted(year(rnd, p, lo, hi) for _ in range(20_000))
    print(f"{label:18} mean={statistics.mean(losses):>8,.0f} p95={losses[int(0.95*len(losses))]:>9,.0f} p99={losses[int(0.99*len(losses))]:>9,.0f} P(loss>0)={sum(l>0 for l in losses)/len(losses):.3f}")

Run with python3 lab_mc.py. Verified output:

baseline           mean=  68,613 p95=  592,662 p99=  814,425 P(loss>0)=0.151
with segmentation  mean=  18,590 p95=  129,339 p99=  493,624 P(loss>0)=0.059

The simulation needs only a few inputs: how likely an incident is in a year, how long it lasts, and what each hour costs. Each should come with its source and a plausible range. Lab 4 uses a fixed seed so that the board can see the same numbers when the run is repeated, and so that a change in result can be traced to a change in assumptions.

4.2 Reading the tail

Segmentation cuts the mean loss from about 68,600 to 18,600 and the probability of any loss from 15.1 % to 5.9 %. The 99th percentile drops less sharply (814,000 to 494,000) because when an incident does happen it can still last two days. If the board's tolerance is "no more than a 1 % chance of losing over 600,000 a year", only the segmented design meets it under these assumptions.

These figures depend on assumptions that deserve their own line on the slide: the incident probabilities, the duration ranges and a single cost per hour. Changing the segmented design's maximum duration from 48 to 72 hours would raise its tail. The board should see which assumption drives the tolerance result before treating the 600,000 threshold as met.

4.3 Who bears the risk

Residual risk at a reclamation plant is not borne only by the utility. Residents near outfalls and the bay ecosystem bear discharge-quality risk; ratepayers bear cost risk. Ethically, a leader should identify these parties, ask whether the regulator or elected body has accepted the risk on their behalf, and avoid accepting on others' behalf what the organisation has no mandate to accept.

At BWRP the board minutes made this explicit by noting that discharge-quality risk to residents falls under the regulator's permit conditions. Daniel's role is to make the affected parties visible in the risk record and to state who has accepted risk on their behalf. Where nobody has that mandate, the risk is escalated rather than quietly accepted.

4.4 Transparency versus exposure

Publishing a detailed security assessment builds public trust but may give attackers a map. A defensible practice is layered disclosure: publish the governance, the risk-acceptance decisions and progress metrics; share technical detail with regulators and sector information-sharing bodies under confidentiality; disclose incidents according to legal duty and promptly to affected people.

For BWRP that could mean publishing the decision to adopt brokered vendor sessions and segmentation progress figures, while sharing the lift-station network design only with the regulator and the sector sharing group. The choice of what goes where should be recorded and reviewed, so that later requests from journalists or residents meet a consistent answer.

Worked example (synthetic BWRP)

Daniel presents the simulation with its assumptions on one slide: 15 % baseline annual incident probability (from sector peers, range 8–25 %), duration uniform 4–72 hours, cost 12,000 per hour, seed 2026. The board accepts segmentation and minutes that discharge-quality risk to residents is covered by the regulator's permit conditions, not by the board's risk appetite alone.

Synthetic case — Bayside Water Reclamation Plant. Every parameter in the simulation is invented.

Errors and limits

Uniform durations are a simplification; heavy-tailed distributions would raise the 99th percentile. A seeded simulation is reproducible, not correct.

Exercises

Synthesis

Advanced risk work reports distributions and tails, names who bears the residual risk, and balances transparency with exposure deliberately.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →

Worked answers

EX016. Segmentation mainly reduces how often an incident happens (15 % → 6 %), but once one happens its duration can still be long (up to 48 h), so the conditional tail shrinks less than the average, which is dominated by incident frequency.

EX017. No. The baseline 99th percentile is 814,425, so more than 1 % of simulated years exceed 600,000 — the tolerance is breached.

EX018. Residents near the outfall, ratepayers who fund recovery costs, and the bay ecosystem (and the businesses depending on it, such as shellfish harvesters) — the regulator and downstream water users are also acceptable.

EX019. (a) Public — it shows governance. (b) Internal only (shared with the regulator on request under confidentiality) — it is an attacker's map. (c) Public — an aggregate count supports accountability without revealing technique.

EX020. A heavier tail adds rare very long outages: the mean rises somewhat, but the 99th percentile rises much more, because the extreme years that define p99 become more extreme.