Chapter 21 — Systems, endpoints and hardware security: system models
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 Components"]
N2["21.2 Control flows"]
N3["21.3 Data flows"]
N4["21.4 Control points"]
N5["21.5 Model use"]
N6["Checking the model"]
N7["Using the model in conversations"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 Components"]
N2["21.2 Control flows"]
N3["21.3 Data flows"]
N4["21.4 Control points"]
N5["21.5 Model use"]
N6["Checking the model"]
N7["Using the model in conversations"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 Components]
|
v
[21.2 Control flows]
|
v
[21.3 Data flows]
|
v
[21.4 Control points]
|
v
[21.5 Model use]
|
v
[Checking the model]
|
v
[Using the model in conversations]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) model Bramley's endpoints, servers and management; (2) show data and control flows; (3) identify where controls act.
21.1 Components
45 laptops, four servers (file, finance, domain, an old application server), a management server, VPN and backup service.
Each component appears as one box on Aisha's one-page model, labelled with its asset tag where it has one. The laptops are BHA-L01 to BHA-L45 and the servers BHA-S01 to BHA-S04. The management server, VPN and backup service are drawn separately, because every control on the laptops depends on at least one of them working. Aisha marks the management server and the domain server as the two most critical components, because every laptop depends on both of them.
21.2 Control flows
The management server sends settings and updates to agents; agents report status back.
Arrows from the management server to the laptops carry settings, encryption policy and updates; arrows back carry status reports. Aisha draws these as control flows, separate from data flows, because a break here is silent. A laptop whose agent stops reporting still works for its user, but receives nothing new and reports nothing. The model therefore shows the weekly inventory comparison as a check on the control flow itself, not only on the devices.
21.3 Data flows
Tenant data flow from the file server to laptops and back; finance data stay on the finance server.
Tenant documents move from the file server to laptops through offline sync, and edits flow back the same way. The finance data stay on the finance server and are reached by three staff. Aisha's check with staff adds a third flow, documents emailed to the partner agency, which crosses a trust boundary and is marked for review. Aisha marks each flow with the data it carries, such as tenant documents or finance records, so the model shows where encryption matters most.
21.4 Control points
Encryption and standard users on laptops; minimal services on servers; agent reports at the management server.
Aisha places each control where the model shows data at rest or in motion. Encryption and standard accounts act on the laptops; the services check and named admin accounts act on the servers; the VPN and firewall act on the network path. Agent reports at the management server provide the evidence that the device controls are in place. Control points without evidence are marked with a question mark on the model until a report or lab can confirm them.
21.5 Model use
The model guides inventory, baseline and service checks in later chapters.
Each later lab starts from a part of the model. The inventory comparison checks the component list; the baseline lab checks the laptop control points; the services lab checks the server control points. When a lab finds something the model lacks, such as the missing backup flow for the old application server, the model is corrected first. The model is reviewed at the end of the project against the final inventory, so its last version matches the fleet Gareth inherits.
Checking the model
Aisha checks the model against the asset register and the management server. The model shows four servers; the register agrees; the management server reports only three, because the old application server was never enrolled. This mismatch becomes part of the inventory work in chapter 22.
She also checks data flows with staff: some tenant documents are sent to a partner agency by email. She adds this flow to the model, marking it for review of encryption in transit and data minimisation.
The finished model fits on one page and is stored with the project's documentation.
Using the model in conversations
When Bramley's managers ask where tenant data live, Aisha points to the model: the file server, laptops through sync, and emails to the partner agency. This helps them understand why encryption and access controls matter at each point.
Trust boundaries
The model marks where data cross trust boundaries: from laptops to the internet, from the office to the partner agency, and from the contractor's network into servers. Each crossing gets a control.
Worked example
Drawing the model, Aisha notices the old application server has no backup flow, which Gareth confirms; backup is added.
Synthetic case. Synthetic.
Errors and limits
Models drift from reality; check them against inventories.
Exercises
- EX061 — Components. List Bramley's four servers. Rubric: 3 = file, finance, domain, old application; 2 = three; 1 = two; 0 = none.
- EX062 — Control flow. What flows between management server and agents? Rubric: 3 = settings and updates out, status back; 2 = partial; 1 = vague; 0 = none.
- EX063 — Backup gap. What gap did the model reveal? Rubric: 3 = old app server lacked backup; 2 = partial; 1 = vague; 0 = none.
Synthesis
Models reveal missing flows and controls.
Continue studying — chapter 21 of 40
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →