◇ OpenCyber Academy
Engineering · Chapter 18 · English

Chapter 18 — Security architecture

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Zones"]
  N2["18.2 Trust boundaries"]
  N3["18.3 Isolated ranges"]
  N4["18.3b Egress control"]
  N5["18.1b Jump hosts"]
  N6["Practice note"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Zones"]
  N2["18.2 Trust boundaries"]
  N3["18.3 Isolated ranges"]
  N4["18.3b Egress control"]
  N5["18.1b Jump hosts"]
  N6["Practice note"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Zones]
    |
    v
[18.2 Trust boundaries]
    |
    v
[18.3 Isolated ranges]
    |
    v
[18.3b Egress control]
    |
    v
[18.1b Jump hosts]
    |
    v
[Practice note]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) place assessment tools in a zone model; (2) define trust boundaries for evidence; (3) choose when to isolate a test range.

18.1 Zones

Assessment laptops, TrackScope, FindingsDesk and the client's assets sit in different trust zones. Traffic from the assessment zone to client assets is only what the ROE allows; traffic back carries evidence into a store the client can audit. Do not put the evidence store on the same VLAN as the targets "for convenience".

Separating the evidence store from targets means a compromised test host cannot quietly rewrite history. ROE-shaped traffic is the only path toward client assets; everything else is dropped and logged. Sam's kickoff includes a traceroute from TrackScope to the store and to a sample target to prove the zones.

18.2 Trust boundaries

Crossing a boundary needs authentication, authorization and logging. A student exporting findings to a personal drive crosses a boundary without a control — forbid it in the ROE and in tool policy.

Personal drives sit outside every client control. Tool policy that blocks export is stronger than a paragraph nobody reads under deadline. Sam treats a blocked export as a successful control, not as friction to remove. He demos the block during kickoff so nobody asks for a bypass later. Exports to the client go through FindingsDesk, which logs who exported which findings and when.

18.3 Isolated ranges

When methods are noisy or the client is fragile, use a synthetic range that mirrors configuration. Results then support claims about the mirrored config, not about production runtime. Say so in the report.

Synthetic case — Riverstone Transit. PulseMap and FindingsDesk run in the security-tools VPC; scanners egress through a controlled proxy that enforces the CIDR allow-list.

Mirrors prove configuration claims when production is too fragile for noise. They do not prove runtime behaviour under live load, and the report must not pretend otherwise. Sam labels every finding from a mirror with the range id and the config revision used.

18.4 Errors and limits

Diagrams age. Re-validate zones at engagement start.

A diagram from last quarter may show a VLAN that no longer exists. Re-validation is a checklist item at engagement start, with a dated screenshot or export in the dossier. If the live path disagrees with the diagram, Sam stops until architecture and ROE are updated together, so the team does not test against a map of a different network. The dated export is hashed like any other evidence file and linked from the kickoff checklist.

18.3b Egress control

Assessment zones need egress allow-lists: only the client's in-scope CIDRs and the evidence store. Open egress turns a compromised laptop into a pivot that the ROE never authorized. Enforce egress in the same policy pipeline as target allow/deny when possible.

Allow-lists for egress shrink the blast of a stolen laptop to what the engagement already permitted. Open DNS and web egress are enough for many silent exfiltration paths. Putting egress in the same pipeline as target checks means one policy language and one audit log. Sam tests a denied egress destination on day one and keeps the log line.

18.1b Jump hosts

Assessment jump hosts are high-value: harden them, log session start/stop, forbid personal file sync agents, and rebuild from golden images between engagements when feasible. A messy jump host undermines every careful zone diagram.

Golden-image rebuilds wipe leftover tools, sync agents and stale credentials between clients. Session logs answer who was on the host when a change occurred. Personal sync agents are forbidden because they copy evidence to unmanaged clouds. Sam's pre-flight fails if a sync agent package is present.

Practice note

Network diagrams for the assessment zone go into the dossier with the same hash discipline as evidence files. When an auditor asks how traffic reached staging, you show the diagram version that was live, not a newer cleaned-up sketch. Treating diagrams as versioned artefacts closes a common gap between architecture intent and what actually ran during the window.

Exercises

Synthesis

Zones, boundaries and honest limits on what a range can prove.

Continue studying — chapter 18 of 50

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →