Compare three controls against the same harm and service costs

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Public activity · 30d

—Participating browsers

—Page views

—Reading sessions

—Exercise opens

Counts reflect browsers that allowed analytics. A reading session requires 30 seconds on a visible page. Browsers are not people.

Day 27 — Compare three controls against the same harm and service costs

Learning task. Recommend an option whose benefit, uncertainty, interruption and reversal can be inspected separately. At 09:35, compare session restriction, S42 write hold and shared-account disablement against one outcome: preventing another unapproved or mistaken S42 mutation while preserving legitimate enrollment. Changing the outcome between rows makes an apparently precise ranking meaningless. “Broadest action” and “least disruptive action” are both incomplete selection rules; effectiveness and accepted cost must each satisfy a gate.

The causal path assumed by a session restriction is that s-77 is active, revocable and relevant to the unwanted write. C03/C09 establish session observations; C05 has no direct session key. Thus even a verified revocation could leave the S42 path unaffected. The S42 hold targets the state operation rather than an unresolved identity. Its failure assumptions are different: all relevant writers must encounter the intended guard, and the legitimate delay must be acceptable. Account disablement targets credential use broadly. Its expected cost includes approved scheduled work and emergency/manual uses of svc-enroll, not merely the suspected transaction. The responder must not hide these costs behind a security confidence percentage.

Lesson table; scroll horizontally to read all columns →

Proposed control at 09:35	Benefit premise to test	Cost to preserve in the decision	Observation and reversal dependency
Restrict `s-77`	Session remains usable and participates in the harmful path; the direct join is currently absent.	Legitimate integration/session interruption; another path can continue.	Identity-owned session-state receipt plus application/service evidence; identity operator and owners decide restoration.
S42-only hold	The guard covers the in-scope S42 mutation routes.	Legitimate S42 corrections/enrollment wait; current wrong state is not repaired.	Application operator receipt, route-specific denial and permitted S40/S41 checks; scoped expiry and rollback ownership.
Disable `svc-enroll`	Credential use is a sufficiently broad supported harm path.	Approved batch and other dependencies may stop; queued work can require reconciliation.	Broader identity/service/emergency-change approval, account-state and business checks, dependency-aware restoration.

Worked recommendation. Propose the bounded S42 hold because C13 supports a harmful stored state and C16 supplies initial delay tolerance, while the session/request relationship is absent and the account-wide costs are broader. Record “conditional on C17-like actual authorization, route design and observable cost,” not “approved by the table.” If the application owner reports that the available mechanism only disables the entire account, the narrow proposal is not implementable as written. Return it for a new decision; do not substitute a broader command. If an authoritative route inventory shows that the hold misses the dominant writer, reopen the ranking. Evidence can change the preferred option without retrospectively changing what the analyst knew.

Contrast. A superficially rigorous matrix assigns security scores 9/10 to account disablement and 6/10 to S42 hold, subtracts a small downtime score and chooses disablement. The weights conceal mandatory service constraints and unsupported causal assumptions. A better comparison uses a gate for owner-accepted service cost and another for plausible, testable harm reduction; only then compare feasible candidates. Do not invent monetary loss, user counts, probabilities or approval thresholds that the case has not supplied.

Offline practice. Write one decision row for each control with benefit premise, source, missing observation, approving capacity, operator, service check and rollback owner. Then evaluate two separate hypothetical owner replies: (A) “the S42 hold has an unguarded job route”; (B) “the session key is demonstrably joined to the offending request in a permitted new source.” For A, mark coverage unresolved and seek redesign or a newly approved alternative. For B, a targeted session action becomes more relevant but still needs active-session, cost and authority checks. These are counterfactual replies, not newly released cards. State what would reverse your ranking and why.

Limits and decision. C16 gives tolerance, not a cost-free option or an indefinitely renewable ten-minute budget. No control is executed by this comparison. Complete EX027 and its worked answer. Keep all three rows so a supervisor can see why alternatives were deferred and what evidence would make them appropriate.

Previous: Day 26 · Week 6 index · Course index · Next: Day 28.

Exercise for this lesson

EX027 — Containment comparison. Objective: compare three controls using one harm target and independent service gates. Inputs: C13–C16, Day 27 and the session/S42/account options. For each give benefit premise, source gap, business cost, approving capacity, operator, verification and reversal dependency. Select a conditional proposal at 09:35 and name one owner observation that would reverse its ranking; do not invent costs, joins or approval. Rubric: 0 = C16 treated as authority or unsupported operation; 1 = three options but missing coverage, service or reversal gate; 2 = comparable options, justified conditional selection and an explicit counterfactual that changes the decision. Worked answer.

Practice the exercises

Open a prompt, write your response, then compare it with the worked answer. Five-choice practice appears where a reviewed question is available.

EX027

Open the prompt →Compare with the worked answer →

Opens in 30 days: — · browsers: —

Checking for a reviewed five-choice question…

Worked answers

EX027 — Model option comparison. Targeted s-77 restriction could reduce use of that session, but the session-to-q-144 join is absent and the identity/service owners must approve it; verification needs a session-state and service check, with identity operator rollback. A ten-minute S42 write hold narrows the harm path and preserves S40/S41, but could block legitimate S42 changes and miss an alternate route; the service owner and incident lead must approve scope/expiry, application operator executes, and a guarded-route observation plus rollback owner are required. Account-wide disablement covers more uses but may stop the approved job and other integration, so it needs broader owner/emergency-change approval and a service-wide recovery plan. At 09:35 propose the S42 hold subject to approval. C16 supplies tolerability, not that approval; uncertain route coverage is the principal failure mode.

Additional professional worked reasoning: Score each option on the same target harm—another unapproved or erroneous S42 write—and on independent legitimate service continuity. A session-only restriction can miss q-144 because s-77 is not joined; account disablement can interrupt approved batch-17; a S42 hold targets smaller scope but must include route-inventory and expiry checks. The preferred 09:35 action is a proposal under C16, not an authorized implementation. Name the observation that would reverse the ranking.

Week 6 Day 27 — worked selection reversal. Keep the same target harm for all three rows. Session restriction depends on an active/relevant s-77 despite the absent q-144 join; identity/service approval, operator receipt and application/service observations would be required. Account disablement risks approved batch and shared dependencies and needs broader authority and restoration design. The S42 hold is a conditional proposal because it targets the operation and C16 supplies tolerance, but unknown routes can defeat it and legitimate S42 work waits. An owner-confirmed uncovered worker path would reopen the design/ranking; a later authenticated session/request join would increase relevance of the session option without granting permission. Neither hypothetical is supplied at 09:35. Reject invented loss figures or a weighted score that masks a mandatory service gate.