jperezduerto.info
Security in depth · Unit 23 · Lesson 10 of 14
Thresholds trade workload and coverage
Does lower volume alone prove a better rule?
Helpful before thisDefenses and detection
After this lesson you can
- Compare alert workload and retained detections against two explicit requirements.
One idea. One evidence table. One reasoned decision.
Count what changed
An invented booking team independently reviews twenty permission changes, including changes that generated no alert. Four were unapproved; sixteen were approved. “Positive” means unapproved under its policy, not proof of malicious intent. Both settings use these same labeled cases with complete input for this comparison.
TP means flagged unapproved changes; FP, flagged approved changes; FN, missed unapproved changes; TN, unflagged approved changes.
| Setting | TP | FP | FN | TN |
|---|---|---|---|---|
| Before | 4 | 4 | 0 | 12 |
| Higher threshold | 3 | 1 | 1 | 15 |
Before, eight alerts give precision 4/8 = 50% and recall 4/4 = 100%. After, four alerts give precision 3/4 = 75% and recall 3/4 = 75%. The quieter queue contains a larger fraction of useful alerts but misses one previously detected positive. Precision and recall happen to match after tuning; their denominators still represent different groups.
Apply both requirements
Assume five minutes of initial triage per alert, including false positives: forty minutes before, twenty after. Deeper investigation is excluded. The owner requires all four known positives retained and triage within twenty-five minutes. Neither setting meets both requirements.
A defensible memo identifies the conflict and evaluates better approval context, narrower tuning, or more review capacity. It does not quietly replace the coverage requirement with a workload target. Changing a requirement needs the owner’s explicit decision and a recorded consequence. These small constructed results cannot establish future performance or coverage on services outside the sample.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
The owner requires all four known positives to be detected and triage to finish within 25 minutes. Which recommendation fits the supplied evidence?
Show the answer
Correct answer: Neither setting meets both; evaluate better context or additional review capacity before accepting a tradeoff. Before needs 40 minutes; after needs 20 but misses one required positive. The unmet requirement needs an explicit decision.
Try it
- WriteWrite a three-line decision memo: calculate review minutes before and after, identify which requirement each setting misses, and propose one change to evaluate while keeping both requirements explicit.