Chapter 16 — Security architecture
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Layers"]
N2["16.2 Evidence sources by layer"]
N3["16.3 Gaps"]
N4["16.4 Segmentation"]
N5["16.5 Central logging"]
N6["16.6 Forensic readiness"]
N7["16.7 Recommendations"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Layers"]
N2["16.2 Evidence sources by layer"]
N3["16.3 Gaps"]
N4["16.4 Segmentation"]
N5["16.5 Central logging"]
N6["16.6 Forensic readiness"]
N7["16.7 Recommendations"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Layers]
|
v
[16.2 Evidence sources by layer]
|
v
[16.3 Gaps]
|
v
[16.4 Segmentation]
|
v
[16.5 Central logging]
|
v
[16.6 Forensic readiness]
|
v
[16.7 Recommendations]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) describe a layered university network architecture; (2) identify where evidence is generated; (3) explain how architecture shapes investigations; (4) recommend logging improvements.
16.1 Layers
The university network has student labs, staff networks, servers, a proxy, email gateway, identity provider and firewall. Each layer controls traffic and generates logs.
For the ws-114 incident, the email gateway handled the phishing message, the proxy saw the visit to the fake page, the identity provider recorded the foreign sign-in, and the workstation held the run key and DLL. Mapping these layers before analysis tells Leah which logs to request and who owns each one, since each layer has a different administrator.
16.2 Evidence sources by layer
Email gateway: message delivery and filtering verdicts. Proxy: web requests by host. Identity provider: sign-ins. Endpoints: process, file and registry artefacts. Firewall: connections allowed or blocked.
The layers give independent views, which is why the proxy and browser history could corroborate each other. Each source also has limits: the gateway does not see what happened after delivery, and the firewall sees connections but not processes. Listing what each layer can and cannot show prevents expecting evidence that a source never recorded.
16.3 Gaps
Student lab machines are reimaged nightly. If ws-114 had been reimaged before seizure, endpoint evidence would be gone, leaving only network and identity logs. Architecture decisions made for convenience can erase evidence.
ws-114 survived only because Grace isolated it during the day, before the night's reimage. Had the alert arrived in the evening, the run key and DLL might have been lost, and the investigation would have depended on the proxy and identity logs alone. The report recommends changing this, as the recommendations below explain.
16.4 Segmentation
Labs are segmented from staff networks, which limits spread. The investigation checks whether ws-114 contacted any other segment.
The check uses firewall and proxy logs to list every destination ws-114 contacted during the incident window. Connections to the staff network would have been blocked by segmentation rules, so their absence in allowed traffic is expected; blocked attempts, however, would show the malware trying to spread. Leah records both allowed and blocked connections, and finds none to the staff network in either list.
16.5 Central logging
Logs sent to a central collector survive endpoint wipes and are time-synchronised.
In the ws-114 case, endpoint logs were local, so they would have vanished with a reimage. Logs forwarded to a central collector would have survived, and their timestamps would come from a synchronised server rather than a workstation running 47 seconds slow. Central logging also makes tampering harder, since an intruder on the endpoint cannot reach the collector's copy of the records. Retention at the collector is set by policy, not by the workstation's disk size, so older events remain available.
16.6 Forensic readiness
Planning what to log, for how long, and how to collect it before incidents happen saves time and preserves evidence. ISO/IEC 27043 includes readiness among its processes.
For Harrowgate, readiness would mean deciding in advance which endpoint events to forward, how long to keep proxy and identity logs, and who can authorise a hold on reimaging. Each choice costs storage and effort, so it is weighed against the cases it would help. The ws-114 case gives concrete arguments for each item.
16.7 Recommendations
Delay nightly reimaging for machines with open alerts; forward endpoint logs centrally.
Both come directly from the gaps found. A machine with an open alert skips its nightly reimage until the security office releases it, which keeps endpoint evidence available. Forwarding endpoint logs centrally removes dependence on the workstation's own clock and storage. Each recommendation states the incident that motivates it, the cost and the owner, so the decision makers can weigh them against each other. Leah adds a third, lower-priority item: record each workstation's clock offset during routine maintenance.
Third-party services
Some evidence lives with external providers: cloud email, learning platforms, outsourced security monitoring. Contracts should state what logs providers keep, for how long, and how the university can obtain them quickly. Leah finds the learning platform keeps sign-in data only 14 days, and lists it as a readiness gap for the security office to raise at renewal.
Worked example
Leah maps the ws-114 incident to the architecture: email gateway delivered the phish; proxy logged the POST; identity provider logged the foreign sign-in; endpoint showed persistence. Had the nightly reimage run, only the first three would remain. She recommends an alert-triggered hold on reimaging.
Synthetic case. The architecture is invented.
Errors and limits
More logs increase storage and privacy duties; collect with purpose.
Exercises
- EX046 — Evidence by layer. Match proxy and identity provider to their evidence. Rubric: 3 = web requests by host; sign-ins; 2 = one; 1 = swapped; 0 = none.
- EX047 — Reimaging risk. What would nightly reimaging have destroyed? Rubric: 3 = endpoint artefacts (persistence, memory, files); 2 = partial; 1 = logs; 0 = none.
- EX048 — Recommendation. What did Leah recommend? Rubric: 3 = alert-triggered hold on reimaging (and central endpoint logs); 2 = partial; 1 = vague; 0 = none.
Synthesis
Architecture decides which evidence exists when an incident occurs; design for readiness.
Continue studying — chapter 16 of 40
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →