◇ OpenCyber Academy
Engineering · Chapter 25 · English

Chapter 25 — Design studio I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 25 — Design studio I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Studio work"]
  N2["25.2 Critique"]
  N3["25.3 Trade-offs"]
  N4["25.4 Documentation"]
  N5["Addressing and VLAN details"]
  N6["Peer review record"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Studio work"]
  N2["25.2 Critique"]
  N3["25.3 Trade-offs"]
  N4["25.4 Documentation"]
  N5["Addressing and VLAN details"]
  N6["Peer review record"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Studio work]
    |
    v
[25.2 Critique]
    |
    v
[25.3 Trade-offs]
    |
    v
[25.4 Documentation]
    |
    v
[Addressing and VLAN details]
    |
    v
[Peer review record]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) develop a detailed segmentation design; (2) present to peers; (3) incorporate critique.

25.1 Studio work

In the first design studio, Kofi turns the architecture into a detailed design: VLANs and subnets per office, firewall interfaces, routing and the policy. He presents it to peers and staff for critique.

A design studio is a structured session where the engineer presents work in progress and invited peers question it. Kofi prepares diagrams, the flow model and open questions, and records every comment. Studios catch design problems while they are cheap to fix.

Inviting reviewers from operations as well as design brings practical concerns, such as maintenance effort, into view early.

25.2 Critique

Peers ask how phones that need to reach the provider's cloud are handled, and whether the CCTV recorder should sit in the server zone. Kofi adds an outbound rule for the phone provider and moves the recorder into the CCTV zone, adjusting rules accordingly.

Good critique addresses the design, not the person, and explains its reasoning. Kofi treats each comment as a hypothesis to check, responding with evidence or a change rather than defending his first choice.

Giving critique well also matters: specific, kind and evidence-based comments help peers more than vague praise or blunt rejection.

25.3 Trade-offs

Placing the recorder in the CCTV zone means cameras never cross a zone boundary, but staff viewing footage must reach it from the staff zone. He adds one narrow rule for viewing.

Studios often surface trade-offs, such as more zones improving isolation but increasing operational load. Kofi records each with the options, criteria and chosen direction, so the decision can be reviewed later.

Making trade-offs explicit prevents later surprise, because stakeholders have seen and accepted the costs of the chosen direction. It also helps when conditions change, because the record shows which assumption drove the decision and therefore which decisions deserve to be reopened.

25.4 Documentation

The revised design is documented with diagrams, subnet tables and the rule list.

After the studio, Kofi writes a short record listing attendees, the material presented, each comment, the response, and actions with owners and dates. He shares it with participants to confirm accuracy. The record shows how the design evolved and why, which helps reviewers of the final thesis and anyone who later maintains the network and wonders why a particular choice was made.

Short, prompt records are more useful than long ones written weeks later.

Addressing and VLAN details

The studio also settles details that are easy to overlook. Each office receives VLAN numbers that are the same across sites for the same zone, so engineers recognise them anywhere. Subnets follow the plan from chapter 11, with each office taking a consistent slice of the address space. Default gateways sit on the branch firewall, so traffic between zones passes through it. These conventions make troubleshooting faster and reduce mistakes, because an engineer can predict a device's VLAN and gateway from its zone and office.

Peer review record

Kofi records every critique point, his response and whether the design changed. Of fourteen points raised, nine lead to changes, three are answered with existing design features and two are deferred to later phases with reasons. The record is attached to the design document. It shows examiners that critique was taken seriously and gives the council a view of options considered and set aside, which is often as useful as the final design itself. Deferred points carry a target phase and an owner, so they are revisited rather than quietly forgotten.

Worked example

After critique, the design has seven allow rules between zones and two outbound internet rules.

Synthetic case. The design is synthetic.

Errors and limits

Ignoring critique to protect a design leads to problems in implementation.

Exercises

Synthesis

Studio critique improves the design before any equipment is touched.

Continue studying — chapter 25 of 50

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →