Chapter 26 — Authorized offensive security and red team: architecture alternatives | Engineering Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 26 — Authorized offensive security and red team: architecture alternatives

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Alternatives"]
  N2["26.2 Criteria"]
  N3["26.3 Decision"]
  N4["26.2b Switching costs"]
  N5["26.3b Exit criteria for alternatives"]
  N6["26.1b Cost models"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Alternatives"]
  N2["26.2 Criteria"]
  N3["26.3 Decision"]
  N4["26.2b Switching costs"]
  N5["26.3b Exit criteria for alternatives"]
  N6["26.1b Cost models"]
  N7["Practice note"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Alternatives]
    |
    v
[26.2 Criteria]
    |
    v
[26.3 Decision]
    |
    v
[26.2b Switching costs]
    |
    v
[26.3b Exit criteria for alternatives]
    |
    v
[26.1b Cost models]
    |
    v
[Practice note]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) compare monolith vs service split for assessment tools; (2) evaluate a "scanner in the cloud" option against data-residency rules; (3) pick an alternative with an explicit rejection of the others.

26.1 Alternatives

A: monolith on a hardened jump host. B: TrackScope / FindingsDesk / PulseMap as separate services. C: SaaS scanner with client data leaving the premises. Each serves different constraints.

Three options keep the analysis honest: local monolith, split services, and SaaS leaving the premises. Constraints differ by residency and ops skill. Sam forbids a fourth mystery option introduced in the last five minutes of debate. A parking-lot list captures late ideas for the next alternatives pass instead of bending the current scores.

26.2 Criteria

Authorization clarity, data residency, fail-closed behaviour, operability by two engineers, cost. Weight safety and residency above novelty.

Weighting safety and residency above novelty stops a shiny SaaS demo from winning on vibes. Operability by two engineers matches Riverstone's real headcount. Sam publishes weights before scoring so nobody moves the goalposts after seeing totals, and each scorer writes one sentence on the decisive criterion. Process-failure notes are read aloud at the next studio so weight-gaming does not become a habit. Reading those notes aloud is awkward on purpose; social cost is part of the control.

26.3 Decision

Riverstone rejected C because fare and staff identity logs must not leave the region. Chose B for independent scaling of reporting, with A as the disaster-fallback (export policy files and run local).

Synthetic case — Riverstone Transit. A vendor demo of C looked slick; counsel blocked it on residency. ADR-011 records the rejection so the question is not reopened monthly.

Rejecting C protects fare and staff logs under residency rules. B scales reporting without forcing every tool to share fate; A remains the offline escape hatch. Sam's ADR quotes the residency clause that killed C.

26.4 Errors and limits

Alternatives analysis that ignores the ROE's data clauses is theatre.

Ignoring ROE data clauses produces an architecture the client cannot legally run. Sam checks those clauses before scoring novelty, cost or developer joy, and any alternative that needs a residency waiver is marked blocked until counsel answers in writing. Waiver requests open a counsel ticket with a due date; engineering does not speculate on the answer in the ADR. Due dates that slip are escalated the same way as open critical findings.

26.2b Switching costs

Architecture alternatives include the cost of changing your mind later. A monolith that already exports signed policy files can grow into services; a SaaS contract with residency exceptions is harder to unwind mid-incident. Prefer options that keep an offline escape hatch for deny/allow.

Offline escape hatches keep deny/allow alive when SaaS or networks die. Contracts with residency exceptions are sticky in an incident. Prefer growth paths that preserve signed policy export. Sam asks each option how a Friday outage would still enforce DENY.

26.3b Exit criteria for alternatives

An alternatives analysis ends with a decision, rejected options with reasons, and a revisit trigger ("reopen if residency law changes"). Without a revisit trigger, people re-argue C every sprint.

Revisit triggers stop endless re-litigation of SaaS. Rejected reasons must be specific enough to falsify later. Sam puts the trigger sentence in the ADR header. Measurable triggers include a named law change, a residency audit finding or a sustained ops-staffing drop below two. Staffing triggers use a four-week average so a single sick week cannot reopen SaaS debates.

26.1b Cost models

Include rough annual cost (compute, seats, staff time for dual approval). An alternative that needs six FTEs to operate fail-closed is not free because the license was cheap. Cost belongs in the decision record beside safety.

Cheap licences that need six FTEs fail the operability criterion. Sam's spreadsheet sits beside the ADR, not in a private folder. When costs spike, the next lead opens the same sheet and sees which assumption broke, without a scavenger hunt. Each cost line carries the date and source of its estimate so stale numbers are easy to spot.

Practice note

Document the skills your chosen alternative demands. Option B's service split needs on-call engineers who understand event ordering; if the squad lacks that skill, budget training or prefer a simpler option until hiring catches up. Architecture that assumes unavailable skills fails closed in theory and fails open in practice when nobody can operate the deny path under stress.

Exercises

EX076 — Criterion. Add one criterion for radio assessments and score A/B/C. Rubric: 3 = sensible criterion + scores; 2 = criterion only; 1 = vague; 0 = none.
EX077 — Reject C. Write the rejection sentence with the residency reason. Rubric: 3 = clear; 2 = partial; 1 = cost only; 0 = accepts C.
EX078 — Fallback. When is monolith A the right runtime? Rubric: 3 = outage/isolation drill with exported policy; 2 = vague; 1 = always; 0 = never.

Synthesis

Choose architecture against weighted constraints; record rejected options.

Continue studying — chapter 26 of 50

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →