Chapter 16 — Security architecture

Lesson map

Lesson 16 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["16.1 Layered defences"]
  N2["16.2 Human roles"]
  N3["16.3 Tolerating error"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["16.1 Layered defences"]
  N2["16.2 Human roles"]
  N3["16.3 Tolerating error"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]

[Learning outcomes]
    |
    v
[16.1 Layered defences]
    |
    v
[16.2 Human roles]
    |
    v
[16.3 Tolerating error]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) describe layered defences; (2) place human roles within an architecture; (3) design so that one human error is not catastrophic.

16.1 Layered defences

Security architecture arranges controls so that several layers protect each asset. For Ashcombe's member database, layers include email filtering, authentication with a second factor, limited access rights, monitoring and backups. No single layer is perfect, but together they reduce the chance that one failure leads to harm. Saltzer and Schroeder (1975) described principles such as least privilege and psychological acceptability, the latter meaning that protection should be easy to use correctly. Nadia sees that these principles connect architecture directly to human factors.

16.2 Human roles

Nadia marks where people act within the architecture: staff decide whether to open emails, managers approve access, IT staff review alerts and members choose passwords for online accounts. Each human role is both a potential weakness and a potential strength. Staff who report suspicious emails act as sensors that detect attacks filters miss. She labels each role with the support it needs, such as clear tools, training or time. An architecture that ignores human roles assumes people will behave perfectly, which never happens in practice.

16.3 Tolerating error

Nadia designs Ashcombe's architecture so that a single mistake does not lead to disaster. If a staff member enters their password on a fake site, the second factor blocks the attacker. If someone opens malware, limited rights stop it spreading and backups allow recovery. If someone sends member data to the wrong address, alerts on bulk exports help detect it. She calls this tolerating error, and it reflects the view that people will sometimes make mistakes, so systems must absorb them rather than depend on perfection.

Worked example

Nadia lays out layered defences, maps human roles and designs the architecture to tolerate individual errors.

Synthetic case. The architecture is synthetic; Saltzer and Schroeder (1975) is real.

Errors and limits

Layers add cost and complexity. Alerts need people to respond.

Exercises

• EX046 — Acceptability principle. What does psychological acceptability mean?
  Show marking criteria

  Rubric: 3 = protection should be easy to use correctly;; 2 = usability;; 1 = vague;; 0 = none.
• EX047 — Staff as sensors. How can staff strengthen the architecture?
  Show marking criteria

  Rubric: 3 = reporting attacks filters miss;; 2 = sensors;; 1 = vague;; 0 = none.
• EX048 — Fake site defence. What blocks an attacker after a password is entered on a fake site?
  Show marking criteria

  Rubric: 3 = the second factor;; 2 = factor;; 1 = backups;; 0 = none.

Synthesis

Layered architecture places people deliberately and absorbs their inevitable mistakes.

Continue studying — chapter 16 of 40

← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →