OpenCyber Academy
Postgraduate · Chapter 1 · English
Course code: OCA-156Chapter 01: OCA-156-C001

Chapter 1 — Advanced security decision-making

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 Decisions first"]
  N2["1.2 Requirements tied to decisions"]
  N3["1.3 Expected loss, roughly"]
  N4["1.4 Value of information"]
  N5["1.5 Decision records"]
  N6["1.6 Time horizons"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 Decisions first"]
  N2["1.2 Requirements tied to decisions"]
  N3["1.3 Expected loss, roughly"]
  N4["1.4 Value of information"]
  N5["1.5 Decision records"]
  N6["1.6 Time horizons"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 Decisions first]
    |
    v
[1.2 Requirements tied to decisions]
    |
    v
[1.3 Expected loss, roughly]
    |
    v
[1.4 Value of information]
    |
    v
[1.5 Decision records]
    |
    v
[1.6 Time horizons]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) frame CTI around decisions rather than topics; (2) write decision-centred intelligence requirements; (3) use expected-loss reasoning without false precision; (4) record decisions and the intelligence behind them.

1.1 Decisions first

A CTI function earns its budget when it changes decisions: what to patch first, which supplier connection to restrict, whether to pay for a new detection capability. Rafael starts NLG's programme by interviewing decision-makers — the chief operating officer, the head of infrastructure, the customs-platform owner — and listing the decisions they face in the next year. The interviews produce a short list rather than a wish list: whether to segment the warehouse management network, which supplier remote access to restrict, and how to prioritise patching on the customs platform. Rafael records each decision with its owner and deadline in a register the COO can see.

1.2 Requirements tied to decisions

Each decision becomes a requirement: "Before the Q3 renewal of remote-access tooling, which access techniques are adversaries using against logistics firms?" A good requirement names the decision, the deadline and the consumer. Topic lists ("ransomware", "APT groups") cannot be closed and never end. Rafael rewrites every topic he receives as a requirement of this form. When the infrastructure head asked for everything about ransomware, the requirement became the segmentation question with a deadline before the budget round. Each requirement is closed when the decision is made and recorded, so the list stays short.

1.3 Expected loss, roughly

Decision-makers compare options. Rough expected-loss reasoning — likelihood band multiplied by impact range — helps them, as long as bands stay bands. "Likely (55–80%) attempt within a year; impact two to five days of warehouse disruption" supports a choice better than a single invented number. For NLG, a warehouse outage of two to five days means missed deliveries and contract penalties, which the operations team can estimate. Rafael gives likelihood and impact as ranges and shows how the choice changes across them. The segmentation decision was supported this way, without anyone claiming a precise probability.

1.4 Value of information

Before collecting, ask whether any plausible answer would change the decision. If the board will fund multi-factor authentication for all remote access regardless, further intelligence on the threat adds little decision value; effort should move elsewhere. At NLG, the board had already decided to require multi-factor authentication for supplier access, so Rafael did not spend effort on more reporting about that threat. He moved the time to the segmentation question, where the answer could change what was funded. Writing down why a requirement was dropped keeps the decision visible to the team. He asks this question for every new request before collection starts.

1.5 Decision records

Record the decision, the date, the intelligence used, its confidence and who decided. Later reviews can then separate bad luck from bad judgment. The segmentation decision record lists the decision, its date, the intelligence on lateral movement into operational networks, the moderate-confidence assessment and the COO as decider. Without such a record, a later incident could make a sound decision look careless, or a lucky one look wise. Rafael stores records in the platform, linked to the requirements they closed, and reviews a sample each year.

1.6 Time horizons

Strategic decisions run over years, operational over weeks, tactical over hours. Each horizon needs different collection and a different cadence of reporting; mixing them in one weekly bulletin satisfies no one. At NLG, the segmentation decision is strategic, supplier access changes are operational, and an incident needs tactical updates within hours. Rafael sets a different product for each: an annual threat profile, a monthly brief for leadership and short incident updates. Each consumer receives only the horizon they act on, which keeps reports short.

Worked example

The infrastructure head asks for "everything about ransomware". Rafael reframes: the real decision is whether to isolate the warehouse management network from office IT this year. He scopes intelligence to techniques used for lateral movement into operational networks in the logistics sector and a short impact estimate. The decision — to fund segmentation — is recorded with a moderate-confidence assessment.

Synthetic case. NLG and its decisions are invented.

Errors and limits

Decision framing can narrow vision; keep a small horizon-scanning effort for surprises.

Exercises

Synthesis

Start from decisions, tie requirements to them, reason in bands, weigh information value and record what was decided.

Continue studying — chapter 01 of 12

← Course home · Course chapter index · Chapter 02 (draft) →

Worked answers

EX001. Example: "By 30 June, for the CIO's remote-access renewal, which initial-access techniques have been used against logistics companies in the last 12 months?"

EX002. When every plausible finding would lead to the same decision — for example, a control already committed regardless of the threat picture.

EX003. "An extortion attempt against NLG within 12 months is likely (55–80%); a successful one would disrupt warehouse operations for two to five days; moderate confidence."

EX004. The decision taken, its date, the intelligence relied on, that intelligence's confidence, and who made the decision.

EX005. Strategic readers need trends over years and little detail; tactical readers need indicators within hours. A weekly mix is too slow for one and too granular for the other.