Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Decisions under uncertainty"]
N2["1.2 The case"]
N3["1.3 Expected cost"]
N4["Lab — comparing response options"]
N5["1.4 Reading the result"]
N6["1.5 Beyond numbers"]
N7["1.6 Recording decisions"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Decisions under uncertainty"]
N2["1.2 The case"]
N3["1.3 Expected cost"]
N4["Lab — comparing response options"]
N5["1.4 Reading the result"]
N6["1.5 Beyond numbers"]
N7["1.6 Recording decisions"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Decisions under uncertainty]
|
v
[1.2 The case]
|
v
[1.3 Expected cost]
|
v
[Lab — comparing response options]
|
v
[1.4 Reading the result]
|
v
[1.5 Beyond numbers]
|
v
[1.6 Recording decisions]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) frame SOC decisions under uncertainty with explicit costs; (2) compare response options by expected cost; (3) recognise when probability estimates change the best option; (4) record decisions and their rationale.
1.1 Decisions under uncertainty
Daniel Okoro leads the SOC of the fictional Meridian Health Insurance and studies on a postgraduate programme at the fictional Hollins College, tutored by Prof. Miriam Achebe. Every night his analysts decide whether to contain, monitor or close alerts without knowing for certain what is happening. Postgraduate practice makes those decisions explicit. The contractor-account alert that opens this book is the first such decision: at 23:40, with a 30% belief that the export was malicious, the night team had to choose between stopping a legitimate batch job and risking a large disclosure of health data. Daniel's programme asks him to write down how that choice was made.
1.2 The case
At 23:40 an alert reports a contractor account exporting claims records from an unusual address. Analysts estimate a 30% chance it is malicious. Disabling the account would stop a contractor's legitimate batch job; waiting risks a large disclosure of health data. The analysts' 30% estimate came from what they could see at that moment: the address was unusual, but the account belonged to a contractor that did run batch exports. Nobody could reach the contractor at that hour, which is why the decision had to be made on partial evidence rather than after a phone call.
1.3 Expected cost
Each option has a cost if the activity is malicious and a cost if benign. Multiplying by probabilities and summing gives an expected cost. It does not predict what will happen; it shows which option is least costly on average given current beliefs. For the contractor alert, the costs differ sharply by option. Containing a benign job costs a delayed batch and an apology; closing a malicious export costs a disclosure of health records. The lab sets each cost from Meridian's own estimates, so the calculation shows how the team's beliefs and values combine, not an objective price of harm.
Lab — comparing response options
"""Expected cost of three response options for a suspicious claims-system session (synthetic)."""
p_malicious = 0.30
options = { # option: (cost if malicious, cost if benign) in thousands
"contain now (disable account)": (20, 8),
"monitor 2 hours then decide": (140, 0.5),
"close as benign": (600, 0),
}
for name, (cm, cb) in options.items():
ev = p_malicious * cm + (1 - p_malicious) * cb
print(f"{name:30} expected cost = {ev:6.1f}k")
for p in (0.05, 0.30):
best = min(options, key=lambda o: p*options[o][0] + (1-p)*options[o][1])
print(f"p(malicious)={p:.2f} -> lowest expected cost: {best}")
Run with python3 lab_decision.py. Verified output:
contain now (disable account) expected cost = 11.6k
monitor 2 hours then decide expected cost = 42.4k
close as benign expected cost = 180.0k
p(malicious)=0.05 -> lowest expected cost: monitor 2 hours then decide
p(malicious)=0.30 -> lowest expected cost: contain now (disable account)
1.4 Reading the result
At a 30% chance of malice, containing now has an expected cost of 11.6k, against 42.4k for monitoring and 180k for closing. At 5%, monitoring becomes cheaper. The best choice depends on the probability, so better evidence is worth gathering quickly. This is why Daniel's analysts kept investigating after containing at 23:52. If evidence had lowered the probability well below 30%, monitoring would have become the cheaper option and the account could have been restored. The contractor's report the next morning ended the uncertainty, but the decision was made, and is judged, on the 30% known at the time.
1.5 Beyond numbers
Costs of health-data disclosure include regulatory, contractual and human harm that is hard to price. Decisions also respect legal duties that are not trade-offs. Expected cost informs judgement; it does not replace it. In the contractor case, a disclosure would have harmed policyholders whose health data was exposed, in ways a figure of 180k cannot capture, and Meridian's duty to protect that data does not depend on the arithmetic. Daniel uses the numbers to check that the choice was reasonable, then asks whether any duty points the other way.
1.6 Recording decisions
The on-call manager logs the decision, the probability estimate, the evidence and who decided. Reviewers can later judge the decision on what was known, not on hindsight. For the contractor incident, the record shows containment at 23:52, the 30% estimate, the unusual address as evidence and the on-call manager as decider. When the contractor later confirmed phished credentials, nobody claimed the analysts had known; the record showed they acted on cost, which protects good decisions that might have turned out differently. Reviews of cases that turned out benign use the same record format, so a correct decision to escalate is judged on what was known at the time.
Worked example
Daniel's analysts contain at 23:52. The next morning, the contractor confirms the export was not theirs: their credentials had been phished. The decision record shows that containment was chosen at 30% belief because the disclosure cost dominated, not because the outcome was known.
Synthetic case. Meridian, Hollins College and all people and figures are invented; costs come from the lab script.
Errors and limits
Probabilities in SOC decisions are judgements; state them as ranges and update them as evidence arrives.
Exercises
- EX001 — Expected cost. Define expected cost for a response option. Rubric: 3 = probability-weighted sum of costs if malicious and if benign; 2 = partial; 1 = vague; 0 = none.
- EX002 — Lab values. Give the three expected costs at p = 0.30. Rubric: 3 = 11.6k, 42.4k, 180.0k; 2 = two; 1 = one; 0 = none.
- EX003 — Switching point. What changes at p = 0.05, and why does it matter? Rubric: 3 = monitoring becomes cheapest; best option depends on probability; evidence valuable; 2 = partial; 1 = vague; 0 = none.
- EX004 — Limits of numbers. Why does expected cost not replace judgement? Rubric: 3 = hard-to-price harms; legal duties not trade-offs; 2 = partial; 1 = it does; 0 = none.
- EX005 — Decision record. What should a decision record contain? Rubric: 3 = decision, probability, evidence, decider, time; 2 = three; 1 = one; 0 = none.
Synthesis
Make SOC decisions explicit: estimate probabilities and costs, compare options and record the reasoning for fair later review.