Chapter 16 — Security architecture
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Layers"]
N2["16.2 Defence in depth"]
N3["16.3 Central management"]
N4["16.4 Dependencies"]
N5["16.5 Simplicity"]
N6["Proportionate architecture"]
N7["Failure thinking"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Layers"]
N2["16.2 Defence in depth"]
N3["16.3 Central management"]
N4["16.4 Dependencies"]
N5["16.5 Simplicity"]
N6["Proportionate architecture"]
N7["Failure thinking"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Layers]
|
v
[16.2 Defence in depth]
|
v
[16.3 Central management]
|
v
[16.4 Dependencies]
|
v
[16.5 Simplicity]
|
v
[Proportionate architecture]
|
v
[Failure thinking]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) design layered endpoint controls; (2) place controls on devices, servers and network; (3) explain dependencies.
16.1 Layers
Device: encryption, standard users, firewall, updates, anti-malware. Server: minimal services, named admin accounts. Network: VPN, segmentation. Management: agent reporting, logs.
Aisha writes each layer as one row of a table with its owner and evidence source. Device controls are set by the management server and shown in its reports; server controls come from role documents and the services check; network controls rest on the VPN and laptop firewall; management depends on agent reports and logs. Any control without an evidence source is marked as unverified.
16.2 Defence in depth
If anti-malware misses a file, standard user rights limit what it can change.
At Bramley, the layers are chosen so that each covers a gap another leaves. If a staff member opens a malicious attachment and anti-malware misses it, the standard account stops it changing system settings. If a laptop is stolen anyway, encryption protects the disk. No single control has to be perfect for tenant data to stay protected. Aisha lists, for each layer, the failure it is meant to cover, so the design can be checked for gaps where no second layer exists.
16.3 Central management
A management agent applies settings and reports status, making Bramley's small IT team effective.
With one IT officer and 45 laptops, central management is what makes the other controls workable at all. Gareth sets encryption, firewall, screen lock and update policy once on the management server, and each laptop's agent applies them. The same agent reports status back, which gives him evidence for every device without visiting it. When the management server itself is down, laptops keep their last settings but miss updates, which is why the weekly routine checks that agents are still reporting.
16.4 Dependencies
Reporting depends on agents being installed; patching depends on laptops connecting.
These two dependencies explain several findings that appear later in the project. Laptops whose agents are broken, such as L19 and L33, receive no settings and report no missing updates, so they look fine by omission. Home laptops that rarely connect fall into the patch tail. Aisha marks each dependency on the architecture sketch so that its failure is checked in the weekly routine. The old application server, S04, showed the same weakness: it was never enrolled, so it received no settings and appeared in no management report.
16.5 Simplicity
Few tools, well configured.
Aisha's design uses tools Bramley already licenses: the management server, the built-in disk encryption, the laptop firewall, the VPN and the backup service. She avoids adding a separate product for each layer, because each new tool needs its own configuration, updates and review time. Fewer tools also means fewer consoles for Gareth to check each week. Aisha records the number of consoles Gareth must check in his weekly routine, which stays at three: the management server, the backup service and the VPN.
Proportionate architecture
Bramley's architecture must be simple enough for one IT officer. The management server applies laptop settings, encryption and updates; the server role documents define services; the VPN and laptop firewall cover network protection; and a weekly routine reviews reports. Each layer is described in one paragraph with its owner and evidence source.
She checks the design against CIS Controls v8 implementation group 1 and finds it covers inventory, secure configuration, account management, data protection, vulnerability management and recovery at a basic level. This gives Bramley's managers confidence that the design is recognised, not improvised.
The architecture also names what it does not cover, such as phones, the website and suppliers' systems, so nobody assumes protection that is not there.
Failure thinking
For each layer, Aisha asks what happens if it fails. If the management server is down, laptops keep their last settings but miss updates; if the VPN fails, home workers cannot reach files but laptops stay protected by encryption and firewall.
Ownership
Every layer has one named owner, usually Gareth, with the contractor for servers.
Worked example
Aisha sketches the architecture and marks the management agent as a key dependency, leading to the inventory work in chapter 22.
Synthetic case. Synthetic.
Errors and limits
Layers without monitoring may fail unseen.
Exercises
- EX046 — Device layer. List device-layer controls. Rubric: 3 = encryption, standard users, firewall, updates, anti-malware; 2 = four; 1 = two; 0 = none.
- EX047 — Depth example. Give a defence-in-depth example. Rubric: 3 = standard rights limit missed malware; 2 = partial; 1 = vague; 0 = none.
- EX048 — Key dependency. Which dependency leads to inventory work? Rubric: 3 = management agent; 2 = partial; 1 = vague; 0 = none.
Synthesis
Layer controls and manage them centrally.
Continue studying — chapter 16 of 40
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →