OpenCyber AcademyLearning outcomes
You will (1) frame security decisions as choices under uncertainty; (2) separate decision quality from outcome quality; (3) identify biases in risk decisions.
1.1 Decisions under uncertainty
Daniel Mensah is a postgraduate student at the fictional Wexford School of Management and an operational risk manager at Halbrook Mutual, a fictional insurer with two thousand staff and a large network of brokers and claims suppliers. His tutor, Dr. Elena Varga, opens the course by asking what a good security decision is. Daniel learns to describe decisions as choices among options with uncertain consequences, judged by whether the choice made sense given the information, values and time available. At Halbrook this matters because the risk committee reviews decisions months later, when only the record of what was known at the time can show whether the choice was reasonable.
1.2 Decision versus outcome
A good decision can have a bad outcome, and a poor decision can be lucky. Halbrook once skipped a supplier review to meet a deadline, and nothing went wrong; managers praised the speed. Daniel learns to judge that decision on its reasoning, not its outcome. Did anyone estimate the risk? Was the appetite respected? Was the decision recorded and revisited? Separating the two protects organisations from learning the wrong lesson from luck and from punishing sound decisions that turned out badly. Daniel suggests that Halbrook's post-decision reviews ask what was known on the day of the skipped supplier review, not merely whether a breach followed.
1.3 Biases
Daniel studies biases that affect risk decisions: availability, where recent headlines inflate some risks; overconfidence, where experts give ranges that are too narrow; anchoring, where a first number shapes later estimates; and optimism about one's own controls. Hubbard and Seiersen (2016) describe calibration training to reduce overconfidence in security estimates. He learns that structured methods, such as recording assumptions and asking for ranges, are practical defences against bias in governance committees. For Halbrook's committee he proposes that every estimate be given as a range with its source, so that anchoring on the first number spoken becomes visible.
Worked example
Daniel frames risk choices as decisions under uncertainty, judges a skipped supplier review on reasoning rather than outcome and lists four biases.
Synthetic case. Wexford, Halbrook and all figures are synthetic; Hubbard and Seiersen (2016) is real.
Errors and limits
Bias labels can be used to dismiss views. Records of reasoning may be incomplete.
Exercises
- EX001 — Good decision. How should a good security decision be judged?
Show marking criteria
Rubric: 3 = by whether the choice made sense given information, values and time;; 2 = reasoning;; 1 = outcome;; 0 = none. - EX002 — Lucky skip. Why was praising the skipped supplier review a mistake?
Show marking criteria
Rubric: 3 = it rewarded luck, not reasoning;; 2 = luck;; 1 = vague;; 0 = none. - EX003 — Overconfidence. What does overconfidence do to expert ranges?
Show marking criteria
Rubric: 3 = makes them too narrow;; 2 = narrow;; 1 = wide;; 0 = none. - EX004 — Calibration source. Which source describes calibration training for security estimates?
Show marking criteria
Rubric: 3 = Hubbard and Seiersen (2016);; 2 = Hubbard;; 1 = Cox;; 0 = none. - EX005 — Bias defence. Name one practical defence against bias.
Show marking criteria
Rubric: 3 = recording assumptions and asking for ranges;; 2 = structure;; 1 = vague;; 0 = none.
Synthesis
Good security decisions are judged by reasoning under uncertainty and protected by structured methods against bias.