◇ OpenCyber Academy
Engineering · Chapter 34 · English

Chapter 34 — Network and communications security: integration

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 34 — Network and communications security: integration

Lesson map

Lesson 34 published. Map, example, EX100.

flowchart TD
  N0["Learning outcomes"]
  N1["34.1 Logging integration"]
  N2["34.2 Identity integration"]
  N3["34.3 Teams"]
  N4["34.4 Monitoring"]
  N5["Time and correlation"]
  N6["Handover to operations"]
  N7["Integration testing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX100"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["34.1 Logging integration"]
  N2["34.2 Identity integration"]
  N3["34.3 Teams"]
  N4["34.4 Monitoring"]
  N5["Time and correlation"]
  N6["Handover to operations"]
  N7["Integration testing"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX100"]

[Learning outcomes]
    |
    v
[34.1 Logging integration]
    |
    v
[34.2 Identity integration]
    |
    v
[34.3 Teams]
    |
    v
[34.4 Monitoring]
    |
    v
[Time and correlation]
    |
    v
[Handover to operations]
    |
    v
[Integration testing]
    |
    v
[Worked example] --> [Exercise EX100]

Learning outcomes

You will (1) integrate logging and monitoring; (2) integrate with identity; (3) coordinate with other teams.

34.1 Logging integration

Firewall and VPN logs flow to the central store using syslog (RFC 5424).

The new firewalls and VPN gateways must send logs into the council's existing central store. Integration means agreeing formats, timestamps in UTC, transport, and field mapping to the common schema, then testing that records arrive complete and promptly. Kofi checks a sample of synthetic events end to end, from device to query result, before relying on the logs for monitoring.

Gaps found in testing are fixed before go-live.

34.2 Identity integration

Jump host authentication uses the council directory with multi-factor authentication.

Network access decisions and administrator logins should use the council's central identity system, not separate local accounts on each device. This means one place to add and remove people, consistent multi-factor authentication, and logs that link actions to named individuals. When someone leaves, removing their central account removes all their access at once, which is far more reliable than updating many devices.

Local emergency accounts remain, tightly controlled and audited.

34.3 Teams

The service desk is trained to recognise segmentation-related issues.

Several council teams share responsibility for the network: infrastructure, service desk, security and application owners. Integration includes agreeing who handles which requests, who approves changes, and who responds to alerts. A simple responsibility table, reviewed with each team, prevents tasks falling between teams and avoids conflicting changes. Kofi also runs short handover sessions so staff understand the new design they will operate.

Contact lists are kept current and tested regularly.

Escalation paths are written down.

34.4 Monitoring

Alerts cover tunnel down, certificate expiry and unusual deny spikes.

Monitoring confirms that the new design keeps working. Dashboards show link health, firewall load, denied connections by zone, and VPN status, with alerts on agreed thresholds. Regular reports compare measures against success targets. Monitoring is assigned to named staff with documented runbooks, so it continues after Kofi's project ends, which is the real test of whether the engineering has been successfully handed over.

Monitoring itself is checked for silent failures.

Time and correlation

Logs from nine firewalls, the jump host and servers must line up in time to be useful. All devices synchronise to the council's time servers, and the central store records both the device timestamp and arrival time. Kofi checks a sample of records and finds one branch firewall eight minutes out because its time source was misconfigured; the fix is made and a monitoring check added. Accurate time is what lets an analyst follow a single event across several devices.

Handover to operations

Integration includes people. Kofi runs sessions with the two network engineers and the service desk, covering the zone model, how to read deny logs, how to request a policy change and what alerts mean. He provides a one-page quick reference for the service desk listing common symptoms, such as a printer that cannot scan, and the likely cause. Calls about blocked services are routed to the network team with the device and time, which speeds diagnosis. Sessions are recorded so new staff can watch them later.

Integration testing

Before declaring integration complete, Kofi runs end-to-end checks: a test deny on a branch firewall must appear in the central store, trigger the correct dashboard count and, for a spike, raise an alert to the on-call engineer. Each step is timed. Testing the whole chain, rather than each component separately, finds gaps such as an alert rule pointing at the wrong log field, which only appears when real records flow through the system. The end-to-end check is repeated monthly so silent breaks are found quickly.

Worked example

Integration testing confirms logs arrive within one minute.

Synthetic case. Events are synthetic.

Errors and limits

Integration gaps appear between teams, not devices.

Exercises

Synthesis

Integration makes the design operable.

Continue studying — chapter 34 of 50

← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →