{"id":8573,"date":"2022-01-26T21:16:36","date_gmt":"2022-01-26T21:16:36","guid":{"rendered":"https:\/\/andrewdoran.uk\/blog\/?p=8573"},"modified":"2022-01-26T21:16:40","modified_gmt":"2022-01-26T21:16:40","slug":"thinking-about-proxies","status":"publish","type":"post","link":"https:\/\/andrewdoran.uk\/blog\/2022\/01\/26\/thinking-about-proxies\/","title":{"rendered":"Thinking about proxies"},"content":{"rendered":"
Recent conversations at work have got me thinking about the proxy metrics that we use, and how much nuance and detail they hide.<\/p>\n

Cybersecurity<\/h1>\n

Last week, we had a look at a tool that presented a \u2018cybersecurity dashboard\u2019 for our organisation. It is a powerful tool, with lots of capabilities for investigating and remediating security issues across our IT infrastructure estate. But what struck me was a big number presented front-and-centre on the first page. It looked a bit like this1<\/a><\/sup>:<\/p>\n

<\/p>\n

It was simply a percentage. I\u2019ve been pondering it since, wondering if it us useful or not.<\/p>\n

80.4%. Is this good? If that\u2019s my organisation\u2019s score, can I sleep well at night? When I was at university, an average score of 70% in your exams and coursework meant that you were awarded with a first-class degree. So that number has always stayed with me and has felt intrinsically \u2018good\u2019. 80.4% is substantially higher than this. But what about that other 19.6%? Can we relax, or do we need to keep pushing to 100%? Can you ever truly be 100% secure if you\u2019re running any<\/em> kind of IT system?<\/p>\n

Perhaps it is meant as a useful jumping off point for investigation. Or it is meant to be used over time, i.e. last week we were 78.9% and now we\u2019re 80.4%, so things are going in the right direction. Maybe both. I\u2019m not sure.<\/p>\n

It\u2019s a common idea that executives don\u2019t want the detail. They simply want to see a big green light that says that things are ok. If there\u2019s no green, they want to know that things are being dealt with in order to bring the amber or red thing back to green again. In the example above, although the \u2018speed gauge\u2019 is blue, it is still an attempt to aggregate all of the cybersecurity data across an organisation into a simple number. To me, it feels dangerous to boil it down to a single proxy metric.<\/p>\n

I likened the single score to a song being reduced to its average frequency. Music can make us laugh, sing or cry. It can make our pulses race and our hearts throb. But the beauty and nuance is completely lost if you take the average of all of the sound and boil it down to one long continuous tone. (Someone has actually done this<\/a> so you can hear examples for yourself.2<\/a><\/sup>)<\/p>\n

Inflation<\/h2>\n

Food writer, journalist and activist Jack Monroe wrote an incredibly insightful thread on the latest inflation figures. The news headlines were screaming that the inflation number is 5.4% \u2014 a 30-year high<\/a>. However, this hides the nuance of what exactly has been increasing in price and what has remained static. As usual, the poorest in society bear a disproportionate brunt of the increase. For people that depend on the cheapest goods, inflation is much higher, as the cost of those goods have been increasing at a much higher rate. Her original thread is well worth a read:<\/p>\n

\n

Woke up this morning to the radio talking about the cost of living rising a further 5%. It infuriates me the index that they use for this calculation, which grossly underestimates the real cost of inflation as it happens to people with the least. Allow me to briefly explain.<\/p>\n

\u2014 Jack Monroe (@BootstrapCook) January 19, 2022<\/a><\/p><\/blockquote>\n