Chapter 3 — Security governance, risk and compliance: specialist evidence

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 FAIR structure"]
  N2["3.2 The simulation"]
  N3["Lab — Monte Carlo loss distribution for a supplier b"]
  N4["3.3 Explaining it"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 FAIR structure"]
  N2["3.2 The simulation"]
  N3["Lab — Monte Carlo loss distribution for a supplier b"]
  N4["3.3 Explaining it"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 FAIR structure]
    |
    v
[3.2 The simulation]
    |
    v
[Lab — Monte Carlo loss distribution for a supplier b]
    |
    v
[3.3 Explaining it]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) build a FAIR-style quantitative risk estimate; (2) interpret a loss distribution; (3) explain specialist evidence to non-specialists.

3.1 FAIR structure

Daniel studies the FAIR model described by Freund and Jones (2015), which decomposes risk into loss event frequency and loss magnitude, each estimated as a range. For a claims supplier data breach scenario, he works with claims, legal and IT staff to estimate frequency between one event in ten years and nearly one a year, most likely about one in three years, and a loss magnitude with a median near three hundred thousand and a long tail from regulatory fines and remediation. These ranges, not single points, become the inputs to the simulation in the next section.

3.2 The simulation

The lab simulates twenty thousand years. Mean annual loss is about one hundred and seventy thousand. In sixty-eight percent of years there is no loss at all, so the median year costs nothing. The ninetieth percentile is about five hundred and fifty-five thousand and the ninety-ninth about one point nine million. The chance of losing more than a million in a year is about four percent. Daniel notes that the mean alone would hide both the many quiet years and the severe tail. A median of zero also explains why managers who have never seen a loss may doubt the scenario is real.

Lab — Monte Carlo loss distribution for a supplier breach scenario

"""FAIR-style Monte Carlo: loss event frequency x loss magnitude (synthetic, stdlib)."""
import random
random.seed(11)
N = 20000
def year():
    n = 0; t = random.expovariate(random.triangular(0.1, 0.8, 0.3))
    while t < 1: n += 1; t += random.expovariate(random.triangular(0.1, 0.8, 0.3))
    return sum(random.lognormvariate(12.6, 0.9) for _ in range(n))
L = sorted(year() for _ in range(N))
print(f"mean annual loss {sum(L)/N/1000:,.0f}k")
print(f"P(no loss) {sum(x == 0 for x in L)/N:.2f}")
for q in (0.5, 0.9, 0.99): print(f"{int(q*100)}th percentile {L[int(q*N)]/1000:,.0f}k")
print(f"P(loss > 1,000k) {sum(x > 1e6 for x in L)/N:.3f}")

Run with python3 lab_fair.py. Verified output:

mean annual loss 170k
P(no loss) 0.68
50th percentile 0k
90th percentile 555k
99th percentile 1,930k
P(loss > 1,000k) 0.041

3.3 Explaining it

Daniel presents the result to the risk committee as a loss exceedance statement: in about one year in twenty-five, losses from this scenario could exceed a million. He explains that the figures depend on estimated ranges, shows the assumptions and invites challenge. Committee members compare it with insurance and credit risks they already manage. He learns that specialist evidence persuades when it is translated into familiar terms and when its uncertainty is visible rather than hidden. Linking the cyber figure to how the committee already reads insurance exposures makes the one-in-twenty-five statement usable in the same discussion.

Worked example

Daniel builds a FAIR-style simulation with mean 170k, 68% loss-free years, 99th percentile 1,930k and a 4% chance of exceeding a million.

Synthetic case. Ranges and results are synthetic; Freund and Jones (2015) is real.

Errors and limits

Estimates depend on expert ranges. Models omit correlated events.

Exercises

• EX011 — FAIR decomposition. Into which two factors does FAIR decompose risk?
  Show marking criteria

  Rubric: 3 = loss event frequency and loss magnitude;; 2 = two;; 1 = vague;; 0 = none.
• EX012 — Mean loss. What mean annual loss did the lab report?
  Show marking criteria

  Rubric: 3 = about 170k;; 2 = 170;; 1 = vague;; 0 = none.
• EX013 — Quiet years. In what share of years was there no loss?
  Show marking criteria

  Rubric: 3 = 68%;; 2 = 0.68;; 1 = vague;; 0 = none.
• EX014 — Tail chance. What is the chance of exceeding a million in a year?
  Show marking criteria

  Rubric: 3 = about 4%;; 2 = 0.041;; 1 = vague;; 0 = none.
• EX015 — Persuasion. What makes specialist evidence persuasive to committees?
  Show marking criteria

  Rubric: 3 = translation into familiar terms and visible uncertainty;; 2 = translation;; 1 = vague;; 0 = none.

Synthesis

Quantitative risk estimates show both quiet years and severe tails when explained in familiar terms.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →