Chapter 18 — Security architecture | Engineering Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Zones and conduits"]
  N2["18.2 Perimeter and zero trust"]
  N3["18.3 Placing controls"]
  N4["18.4 Simplicity"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Zones and conduits"]
  N2["18.2 Perimeter and zero trust"]
  N3["18.3 Placing controls"]
  N4["18.4 Simplicity"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Zones and conduits]
    |
    v
[18.2 Perimeter and zero trust]
    |
    v
[18.3 Placing controls]
    |
    v
[18.4 Simplicity]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) describe zone-based architecture; (2) compare perimeter and zero trust models; (3) place controls in an architecture.

18.1 Zones and conduits

A zone groups systems with similar trust and function; a conduit is the controlled path between zones. This vocabulary, common in industrial security, suits the council well. Kofi proposes six zones: staff, servers, voice, CCTV, guest and management. Each conduit has a defined set of permitted services and a control point, usually a firewall. The architecture is easy to explain to managers because it mirrors how they already think about departments and access, and easy to verify because each conduit can be tested separately.

18.2 Perimeter and zero trust

Traditional designs trust everything inside the perimeter. NIST SP 800-207 describes zero trust, where every access request is evaluated using identity, device state and context, regardless of network location. The council cannot move to full zero trust in one project, but Kofi's design takes steps in that direction: internal zones do not trust each other by default, management access requires authentication through a jump host, and remote access is tied to user identity rather than to a shared tunnel. He describes the design as segmentation with zero trust principles, not as zero trust itself.

18.3 Placing controls

Controls are placed where they are most effective. Inter-zone filtering sits on a pair of firewalls at the main office and smaller firewalls at branch offices. Encryption protects links between offices. Host firewalls add depth. Logging collects decisions at each control point. Kofi draws a control placement diagram showing each control and the threat it addresses, so that gaps, such as an uncontrolled supplier connection, are visible at a glance.

Each placement is recorded on the diagram with its purpose.

18.4 Simplicity

Saltzer and Schroeder's economy of mechanism argues for designs simple enough to check. Kofi resists adding more zones than the council can manage. Six zones with clear purposes are easier to operate correctly than fifteen finely divided ones, and errors in complex policies are a known risk documented by Wool (2004).

Simple designs have fewer parts to misconfigure and are easier to review and operate. Every extra zone, exception or special path adds a place for errors. Engineers prefer the simplest design that meets the requirements, and justify any added complexity by a specific need.

Worked example

Kofi's architecture diagram shows six zones, eleven conduits and five control types, with a legend mapping each control to the threats from chapter 15.

Synthetic case. The architecture is synthetic.

Errors and limits

Calling a design zero trust when it only adds segmentation overstates its protection and confuses stakeholders.

Exercises

EX052 — Zone vocabulary. Define zone and conduit in one sentence each. Rubric: 3 = both correct with example;; 2 = both;; 1 = one;; 0 = none.
EX053 — Zero trust claim. Why does Kofi avoid calling his design zero trust? Rubric: 3 = only partial adoption, honesty;; 2 = partial;; 1 = vague;; 0 = none.
EX054 — Zone count. Argue for six zones rather than fifteen. Rubric: 3 = manageability and error risk with citation;; 2 = simpler;; 1 = vague;; 0 = none.

Synthesis

A zone and conduit architecture with zero trust principles gives the council a clear, verifiable structure.

Continue studying — chapter 18 of 50

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →