Chapter 23 — Network and communications security: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Threat analysis"]
N2["23.2 Failure analysis"]
N3["23.3 Prioritisation"]
N4["23.4 Residual risk"]
N5["Supplier access threats"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Threat analysis"]
N2["23.2 Failure analysis"]
N3["23.3 Prioritisation"]
N4["23.4 Residual risk"]
N5["Supplier access threats"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Threat analysis]
|
v
[23.2 Failure analysis]
|
v
[23.3 Prioritisation]
|
v
[23.4 Residual risk]
|
v
[Supplier access threats]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) analyse threats against the design; (2) analyse failure modes; (3) prioritise mitigations.
23.1 Threat analysis
Kofi walks through each conduit and asks what could go wrong: a compromised staff laptop reaching servers over permitted services, a stolen branch firewall, a misconfigured rule opening guest access, interception of inter-office traffic, and abuse of supplier access. For each, he records likelihood, impact and existing controls. This structured approach avoids focusing only on dramatic threats.
Each threat is recorded with its likely source and the zones it affects.
Insiders and suppliers are included alongside outside attackers.
Evidence for each is cited.
23.2 Failure analysis
Security devices can fail. A firewall failure at the main office would isolate all branches; a certificate expiry would drop tunnels; a logging server failure would blind monitoring. Kofi uses a simple failure modes and effects table, listing each failure, its effect, detection method and mitigation.
Failure analysis asks what happens when parts break: a firewall, a link, a power supply. For each, engineers record the effect, how it would be detected and the planned response.
Shared causes are noted.
23.3 Prioritisation
Highest priority mitigations: redundant firewalls at the main office, certificate expiry monitoring, policy change review and supplier access through the jump host with time-limited accounts. Lower priority: redundant logging, since temporary loss of logs is less harmful than loss of connectivity.
Threats and failures are ranked by likelihood and impact, using evidence where possible. High-ranked items get controls first; low-ranked ones may be accepted, with reasons recorded and reviewed later.
The ranking is revisited after each incident.
Changes in rank are dated.
23.4 Residual risk
Some risk remains: compromised staff laptops can still reach servers over permitted services. This is addressed by host controls and monitoring, not segmentation, and is stated as residual risk.
Residual risk is what remains after controls are applied. No design removes all risk, so engineers state what remains, why it is acceptable, and who accepted it. The council's risk owner signs the acceptance, and the list is reviewed when circumstances change, such as a new service or a new type of incident.
Supplier access threats
Supplier connections deserve particular attention because they are trusted by design yet managed by another organisation. If the CCTV supplier's own systems were compromised, their access could become an entry point to the council. Kofi's analysis lists the controls that limit this: named accounts rather than a shared login, multi-factor authentication, access only through the jump host, access limited to the CCTV zone, and accounts enabled only for agreed maintenance windows. Each control reduces either the likelihood of misuse or the reach of any misuse.
Worked example
The failure table lists nine failure modes; four are ranked high and get mitigations in the design.
Synthetic case. Analysis is synthetic.
Errors and limits
Threat analysis that ignores operational failures produces designs that are secure but fragile.
Exercises
- EX067 — Threat example. Describe one threat that segmentation does not address. Rubric: 3 = compromised staff laptop over permitted services;; 2 = example;; 1 = vague;; 0 = none.
- EX068 — Failure effect. What is the effect of main-office firewall failure without redundancy? Rubric: 3 = branches isolated;; 2 = outage;; 1 = vague;; 0 = none.
- EX069 — Residual risk. How is residual risk from permitted flows handled? Rubric: 3 = host controls and monitoring, stated explicitly;; 2 = monitoring;; 1 = vague;; 0 = none.
Synthesis
Combining threat and failure analysis yields a design that is both secure and resilient.
Continue studying — chapter 23 of 50
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →