◇ OpenCyber Academy
Engineering · Chapter 45 · English

Chapter 45 — Independent design review

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 45 — Independent design review

Lesson map

Lesson 45 published. Map, example, EX133.

flowchart TD
  N0["Learning outcomes"]
  N1["45.1 Preparing the review"]
  N2["45.2 Findings"]
  N3["45.3 Responses"]
  N4["45.4 Value of review"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX133"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["45.1 Preparing the review"]
  N2["45.2 Findings"]
  N3["45.3 Responses"]
  N4["45.4 Value of review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX133"]

[Learning outcomes]
    |
    v
[45.1 Preparing the review]
    |
    v
[45.2 Findings]
    |
    v
[45.3 Responses]
    |
    v
[45.4 Value of review]
    |
    v
[Worked example] --> [Exercise EX133]

Learning outcomes

You will (1) prepare a design for independent review; (2) respond to reviewer findings; (3) record review outcomes.

45.1 Preparing the review

Before building, Lindiwe submits her recovery design for independent review by an engineer from another organisation, arranged by Prof. Hale. She prepares a package: problem statement, architecture, dependency list, recovery steps, test plan and known risks. She writes a short guide explaining what feedback she most needs. Prof. Hale notes that reviewers give better feedback when the author states open questions honestly instead of presenting the design as finished. The reviewer receives the complete package two weeks before the formal review meeting.

45.2 Findings

The reviewer raises four findings. The recovery environment uses the same administrator credentials as production, so an attacker holding them could also damage the recovery. Recovery scripts are stored on a server that ransomware could encrypt. The test plan does not include restoring from backups older than a day, in case recent backups are corrupted. Finally, the design does not say who decides to start recovery. She thanks the reviewer and asks a follow-up question about each finding to make sure she has understood it correctly.

45.3 Responses

Lindiwe responds to each finding. She creates separate credentials for the recovery environment, held offline. She stores scripts in version control with an offline copy. She adds a test restoring from week-old backups. She writes a decision rule: the security lead and operations director jointly authorise recovery, with deputies named. She records each response in a table, with the reviewer's agreement noted beside each. The reviewer reviews the updated design two weeks later and confirms in writing that all four findings are resolved.

45.4 Value of review

Lindiwe reflects that three of the four findings concerned the recovery itself being vulnerable to the same attack it was meant to survive. She had focused on rebuilding speed and overlooked this. Prof. Hale notes that independent reviewers bring different assumptions, which is exactly why reviews find problems authors cannot. The review record joins the evidence dossier. She adds a section to her thesis plan describing the review and its effect on the design, because she believes other engineers would benefit from seeing how her assumptions changed after independent scrutiny.

Worked example

Lindiwe prepares a review package, receives four findings including shared credentials and exposed scripts, responds with offline credentials, offline scripts, older restore tests and a decision rule.

Synthetic case. The review is synthetic.

Errors and limits

A recovery environment sharing production credentials can be destroyed by the same attacker.

Exercises

Continue studying — lesson 45 (chapter 45 of 50)

← Chapter 44 · Course chapter index · Chapter 46 →

Continue to the next authored lesson.