Chapter 18 — Security architecture | Engineering Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Zones"]
  N2["18.2 Why isolate examination"]
  N3["18.3 Forensic readiness"]
  N4["18.4 Logging architecture"]
  N5["18.5 Time synchronisation"]
  N6["18.6 Architecture documentation"]
  N7["18.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Zones"]
  N2["18.2 Why isolate examination"]
  N3["18.3 Forensic readiness"]
  N4["18.4 Logging architecture"]
  N5["18.5 Time synchronisation"]
  N6["18.6 Architecture documentation"]
  N7["18.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Zones]
    |
    v
[18.2 Why isolate examination]
    |
    v
[18.3 Forensic readiness]
    |
    v
[18.4 Logging architecture]
    |
    v
[18.5 Time synchronisation]
    |
    v
[18.6 Architecture documentation]
    |
    v
[18.7 Review]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) design a secure architecture for a forensic lab network; (2) separate zones by trust; (3) plan logging for forensic readiness; (4) explain forensic readiness for organisations.

18.1 Zones

Northfield's network has an office zone (email, web), an examination zone (workstations, evidence store) with no internet access, and an isolated analysis zone for suspicious files. Data move between zones only through controlled transfer points that log every file.

Transfer points might be a dedicated workstation with a scanner and a one-way data diode, or a manual process using freshly formatted media. Either way, each transfer records what moved, its hash, who moved it and why. Priya's design also blocks wireless interfaces on examination machines, because an isolated network is only isolated if nobody can bridge it by accident.

18.2 Why isolate examination

Internet access from examination workstations risks evidence leaking out and malware in evidence reaching the internet. Offline updates go through a vetted transfer process.

Evidence can contain live malware, and some malware looks for internet access before revealing its behaviour. A connected examination workstation could allow a sample to contact its operators, warning them that they are under investigation. Updates for tools and signatures are downloaded in the office zone, checked against vendor hashes, and then carried through the transfer point.

18.3 Forensic readiness

Organisations that may need to investigate incidents should prepare before they happen: decide what logs to keep, how long, and how to collect them soundly. ISO/IEC 27043 includes readiness processes. For a company, readiness lowers investigation cost and improves the evidence available.

A readiness plan lists the questions an investigation would need to answer, such as who logged in, which files left the network and which processes ran, and makes sure the logs for each answer exist, are kept long enough and are protected. It also names who can authorise collection and how evidence would be preserved. Testing the plan with a tabletop exercise finds gaps before a real incident does.

18.4 Logging architecture

Logs go to a central collector with synchronised time, integrity protection and retention matched to likely investigation needs.

Integrity protection can mean forwarding logs as they are written to a collector that sources cannot alter, plus periodic hashing or signing of stored batches. Retention is set by the questions logs must answer. Authentication logs might be kept for a year, while high-volume network logs are summarised after a month. Priya documents each retention period with its reason. Collector storage is sized from measured daily volume.

18.5 Time synchronisation

All systems sync to a common time source; drift is monitored, because correlating logs depends on it.

Monitoring compares each system's clock with the reference at intervals and alerts when the drift passes a threshold, such as one second. The alert history becomes evidence in its own right. If a server's clock was known to be 40 seconds fast during a given week, events from that server can be corrected with confidence, and the correction can be justified from the record.

18.6 Architecture documentation

Diagrams, data-flow descriptions and decision records let auditors and new staff understand why the design is as it is.

A decision record states the problem, the options considered, the choice made, its consequences and the date. For example: 'Examination zone has no internet; updates arrive by transfer point. Consequence: signature updates can lag by up to a day.' New staff read the records to learn why things are as they are, which stops well-meant changes from undoing important controls. Superseded records stay on file.

18.7 Review

Architectures are reviewed when threats, tools or regulations change.

A review trigger might be a new evidence type, such as cloud account exports arriving in volume, or a regulator issuing guidance on remote access. The review checks each zone, transfer point and logging rule against the change, and records whether anything needs to be updated. An unchanged design after a review is a legitimate outcome, as long as the review is documented. Each review names an owner for any follow-up change and a date by which it should be done.

Remote examiners

Some examiners work from regional offices. Rather than opening the examination zone to remote access, Northfield places small offline workstations locally and ships verified images on encrypted drives with hash manifests, accepting slower turnaround for stronger isolation, and records the decision.

Worked example

A client company asks Northfield why its incident investigation took weeks. Priya's review finds endpoint logs kept only seven days and clocks drifting by minutes. Her readiness recommendations: 90-day central retention, network time sync, and a documented collection procedure.

Synthetic case. The company is invented.

Errors and limits

Retention costs money and raises privacy duties; keep what has a purpose, for a stated period.

Exercises

EX052 — Three zones. Name the three zones and their purposes. Rubric: 3 = office, examination (offline), analysis (isolated); 2 = two; 1 = one; 0 = none.
EX053 — Readiness defined. What is forensic readiness? Rubric: 3 = preparing logs/procedures before incidents to collect sound evidence; 2 = partial; 1 = response; 0 = none.
EX054 — Retention trade-off. Why not keep all logs forever? Rubric: 3 = cost and privacy duties; keep with purpose and period; 2 = one; 1 = no reason; 0 = none.

Synthesis

Zone separation protects evidence; forensic readiness makes future investigations possible and cheaper.

Continue studying — chapter 18 of 50

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →