Chapter 28 — Network and communications security: failure analysis

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 How controls fail"]
  N2["28.2 Fail open or fail closed"]
  N3["28.3 Human workarounds"]
  N4["28.4 Near misses"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 How controls fail"]
  N2["28.2 Fail open or fail closed"]
  N3["28.3 Human workarounds"]
  N4["28.4 Near misses"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 How controls fail]
    |
    v
[28.2 Fail open or fail closed]
    |
    v
[28.3 Human workarounds]
    |
    v
[28.4 Near misses]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) analyse how controls fail; (2) plan for failure safely; (3) learn from near misses.

28.1 How controls fail

Controls fail in several ways: misconfiguration, hardware failure, expired credentials, overload and human workarounds. Priya lists each control in her design and asks how it could fail. The firewall could be misconfigured or fail; the guest passphrase could leak; certificates could expire; logs could stop arriving; staff could plug a visitor's device into a staff network port. For each, she notes how the failure would be noticed and what would limit damage. Controls without any way of noticing failure need attention first.

28.2 Fail open or fail closed

When a control fails, it can fail open, letting traffic through, or fail closed, blocking it. A failed firewall usually fails closed, cutting services; a failed logging system fails open in effect, since traffic continues unrecorded. Neither is always right. For clinical services, failing closed could delay patient care, so Priya plans a spare firewall configuration and a quick recovery procedure rather than any bypass. Deliberately documented choices are better than discovering behaviour during an outage. She records the expected failure mode of each control in the design document.

28.3 Human workarounds

When controls get in the way, people find ways around them. If clinical staff cannot print from a cart because a rule is missing, someone might connect the cart to the staff wireless. Workarounds often defeat security more completely than attackers do. Priya plans a quick route for staff to report blocked work, a target to fix genuine needs within a day, and monitoring for devices appearing in the wrong group. Reducing friction is part of making controls survive in practice.

28.4 Near misses

A near miss is an event that could have caused harm but did not, such as a certificate found with two days left. Priya recommends recording near misses alongside incidents, with a short note on what nearly happened and what will prevent it. Near misses are far more common than incidents, so they offer many more chances to learn. Organisations that only study actual incidents learn slowly and often only after harm has occurred. A short monthly review of near misses keeps the lessons visible and turns each one into a specific improvement with an owner.

Worked example

Priya's failure table covers seven controls; logging has no failure detection and becomes the first fix.

Synthetic case. Failure analysis is synthetic.

Errors and limits

Assuming a control works because it was configured once ignores later failures.

Exercises

• EX082 — Fail-open example. Give an example of a control that effectively fails open.
  Show marking criteria

  Rubric: 3 = logging failure; traffic continues unrecorded;; 2 = logging;; 1 = firewall;; 0 = none.
• EX083 — Workaround prevention. How can staff workarounds be reduced?
  Show marking criteria

  Rubric: 3 = quick reporting route and fast fixes for genuine needs;; 2 = fix fast;; 1 = punish;; 0 = none.
• EX084 — Near miss value. Why record near misses?
  Show marking criteria

  Rubric: 3 = more frequent, learning before harm;; 2 = learning;; 1 = unnecessary;; 0 = none.

Synthesis

Planning for how controls fail, including human workarounds, makes designs resilient in practice.

Continue studying — chapter 28 of 40

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →