Chapter 2 — Discrete mathematics
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Graphs for networks"]
N2["2.2 Sets and relations"]
N3["2.3 Reachability and closure"]
N4["2.4 Counting"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Graphs for networks"]
N2["2.2 Sets and relations"]
N3["2.3 Reachability and closure"]
N4["2.4 Counting"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 Graphs for networks]
|
v
[2.2 Sets and relations]
|
v
[2.3 Reachability and closure]
|
v
[2.4 Counting]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) model networks as graphs; (2) use sets and relations for policy; (3) reason about paths and reachability.
2.1 Graphs for networks
A network is naturally a graph: devices or zones are vertices and links or permitted flows are edges. In Ashcombe's flat network, every zone can reach every other, so the zone graph is complete. Segmentation removes edges. Graph theory lets Kofi count paths, find which vertices are reachable from a compromised one and check that no unintended path exists, for example from guest Wi-Fi to the file servers through some intermediate zone.
Treating zones as nodes and permitted flows as directed edges lets Kofi ask exact questions: which zones can reach the file servers, and through how many hops. Direction matters, because a rule allowing staff to reach printers does not allow printers to reach staff, and confusing the two is a common design error.
2.2 Sets and relations
A firewall policy can be described as a relation: a set of ordered pairs of source and destination zones, each with permitted services. Set operations answer design questions. The intersection of what is allowed and what is needed shows justified rules; the difference between allowed and needed shows excess access. Kofi writes the needed flows as a set first, then designs rules to match it exactly, which is the least privilege principle of Saltzer and Schroeder expressed mathematically.
Writing the allowed relation and the needed relation as sets makes review mechanical: excess access is the difference between them.
2.3 Reachability and closure
Direct rules are not the whole story. If guest can reach a print server and the print server can reach file servers, guest has an indirect path. The transitive closure of the reachability relation captures all such paths. Kofi computes closures for candidate designs to confirm that removing one edge actually isolates a zone rather than leaving a detour.
The transitive closure of the allowed relation shows every pair that can communicate through intermediate zones, including paths no single rule mentions. If a guest zone can reach a print server, and the print server can reach file servers, then guests indirectly reach files. Reviewing the closure, not just the rule list, is what exposes such chains.
2.4 Counting
With six zones there are thirty directed pairs. Each pair can be allowed or denied for each service, so the number of possible policies is enormous. Counting shows why designs need principles, such as default deny, rather than case-by-case choices.
With n zones there are n times n minus one directed pairs, so eight zones give fifty-six. Multiply by dozens of services and the space of possible rule sets is vast. Default deny reduces the decision to listing the few flows that are needed, which is both shorter to write and far easier to review than listing everything forbidden.
Worked example
For zones {guest, print, files} with edges guest→print and print→files, the closure adds guest→files, revealing an indirect path that the direct rules hid.
Synthetic case. Zones are synthetic.
Errors and limits
Reachability on zones ignores which services are permitted; a full model needs the service dimension too.
Exercises
- EX004 — Excess access. Given allowed A and needed N, which set shows excess access? Rubric: 3 = A minus N with explanation;; 2 = A−N;; 1 = other;; 0 = none.
- EX005 — Indirect path. Find the closure for a→b, b→c, c→d and list new pairs. Rubric: 3 = a→c, a→d, b→d;; 2 = two;; 1 = vague;; 0 = none.
- EX006 — Pair count. How many directed pairs exist among 8 zones? Rubric: 3 = 56 with reasoning;; 2 = 56;; 1 = wrong;; 0 = none.
Synthesis
Graphs and relations make segmentation designs precise and expose indirect paths.
Continue studying — chapter 02 of 50
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →