Chapter 19 — Security architecture and engineering: scope and theory

Lesson map

Lesson 19 published. Map, example, EX055.

flowchart TD
  N0["Learning outcomes"]
  N1["19.1 Scope"]
  N2["19.2 Classic principles"]
  N3["19.3 Theory in reviews"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX055"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["19.1 Scope"]
  N2["19.2 Classic principles"]
  N3["19.3 Theory in reviews"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX055"]

[Learning outcomes]
    |
    v
[19.1 Scope]
    |
    v
[19.2 Classic principles]
    |
    v
[19.3 Theory in reviews]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX055]

Learning outcomes

You will (1) state what security architecture and engineering cover; (2) apply Saltzer and Schroeder's principles to Fernway; (3) relate theory to practical design reviews.

19.1 Scope

Lucas writes a short essay on the scope of the field. Security architecture describes how protection is arranged across an organisation; security engineering is the discipline of building systems that stay dependable under attack, as Anderson (2020) puts it. Both cover people, processes and technology, and both work across the life cycle from requirements to retirement. NIST SP 800-160 Vol. 1 Rev. 1 frames this as systems security engineering, integrated into normal engineering rather than added at the end. Lucas notes that at a co-operative of Fernway's size one person often does both.

19.2 Classic principles

Lucas applies Saltzer and Schroeder's (1975) design principles to Fernway. Economy of mechanism suggests one identity provider rather than separate logins per system. Fail-safe defaults mean new staff accounts start with no access. Complete mediation means every request to the stock system is checked, not just the first. Least privilege means warehouse accounts cannot change prices. Psychological acceptability means controls must fit busy store routines, or staff will bypass them. He finds that principles nearly fifty years old still explain most of Fernway's weaknesses.

19.3 Theory in reviews

Hannah asks how theory helps day to day. Lucas turns the principles into review questions for new projects: what is the default access, is every request checked, who has the least privilege needed, and will staff find the control acceptable. He uses them on a proposed staff rota app and finds that it would give every manager access to all stores' rotas, breaking least privilege. The vendor adds store-level scoping. Theory gives reviewers a shared vocabulary and a checklist grounded in decades of experience.

Worked example

Lucas defines the field, applies five Saltzer and Schroeder principles to Fernway and uses them to fix a rota app's access scope.

Synthetic case. Fernway and the rota app are synthetic; Anderson (2020), SP 800-160v1r1 and Saltzer and Schroeder (1975) are real.

Errors and limits

Principles can conflict, such as least privilege versus acceptability. Judgement is still needed.

Exercises

• EX055 — Fail-safe default. How does Fernway apply fail-safe defaults?
  Show marking criteria

  Rubric: 3 = new staff accounts start with no access;; 2 = no access;; 1 = open access;; 0 = none.
• EX056 — Acceptability. Why does psychological acceptability matter in stores?
  Show marking criteria

  Rubric: 3 = controls that do not fit routines are bypassed;; 2 = bypass;; 1 = vague;; 0 = none.
• EX057 — Rota app finding. What did the principles reveal about the rota app?
  Show marking criteria

  Rubric: 3 = every manager could see all stores, breaking least privilege;; 2 = least privilege;; 1 = vague;; 0 = none.

Synthesis

Classic principles remain practical review tools that link theory to everyday design decisions.

Continue studying — chapter 19 of 40

← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →