Chapter 15 — Security fundamentals | Engineering Security architecture and engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Security fundamentals

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Core vocabulary"]
  N2["15.2 Design principles in use"]
  N3["15.3 Kinds of controls"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Core vocabulary"]
  N2["15.2 Design principles in use"]
  N3["15.3 Kinds of controls"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Core vocabulary]
    |
    v
[15.2 Design principles in use]
    |
    v
[15.3 Kinds of controls]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) define assets, threats, vulnerabilities and risk; (2) apply the Saltzer and Schroeder principles to a design; (3) distinguish preventive, detective and corrective controls.

15.1 Core vocabulary

Sofia's security fundamentals course gives precise words. An asset is something of value, such as the fare database. A threat is a potential cause of harm, such as a fraud group. A vulnerability is a weakness a threat could exploit, such as an unauthenticated interface. Risk combines the likelihood that a threat exploits a vulnerability with the impact on the asset; NIST SP 800-30 Rev. 1 describes how to assess it. Using these words carefully avoids confused debates in which one person talks about attackers and another about bugs, each thinking they mean the same thing.

15.2 Design principles in use

Sofia applies Saltzer and Schroeder's principles to the refund service from chapter 14. Least privilege: support staff can view refunds but only supervisors can approve large ones. Fail-safe defaults: if the authorisation service is unreachable, refunds are refused, not approved. Complete mediation: every refund request is checked, not only the first in a session. Open design: security does not depend on hiding how the service works. Psychological acceptability: approval screens are simple enough that supervisors do not look for shortcuts. Writing each principle beside a concrete design choice makes abstract ideas useful in review.

15.3 Kinds of controls

Controls can prevent, detect or correct. Authentication and authorisation prevent unauthorised refunds. Logging and monitoring detect suspicious patterns, such as one card receiving many refunds. Corrective controls restore normal operation, such as reversing fraudulent refunds and revoking compromised accounts. Sofia learns that no preventive control is perfect, so every important asset needs detection and correction too. ISO/IEC 27002:2022 groups controls into organisational, people, physical and technological themes, a different view that helps check whether non-technical controls such as training and procedures have been considered.

Worked example

Sofia defines asset, threat, vulnerability and risk for the refund service, maps five design principles to concrete choices and lists preventive, detective and corrective controls.

Synthetic case. The refund service and controls are synthetic; SP 800-30 Rev. 1, Saltzer and Schroeder (1975) and ISO/IEC 27002:2022 are real.

Errors and limits

Vocabulary varies between standards; define terms in each document. Principles can conflict and require judgement.

Exercises

EX043 — Vulnerability versus threat. Give a Corvia example of a threat and of a vulnerability. Rubric: 3 = threat: fraud group; vulnerability: unauthenticated interface;; 2 = both;; 1 = swapped;; 0 = none.
EX044 — Fail-safe refund. How does fail-safe default apply when the authorisation service is down? Rubric: 3 = refunds are refused, not approved;; 2 = refuse;; 1 = approve;; 0 = none.
EX045 — ISO themes. What four themes does ISO/IEC 27002:2022 use to group controls? Rubric: 3 = organisational, people, physical, technological;; 2 = three;; 1 = one;; 0 = none.

Synthesis

Precise vocabulary, explicit principles and balanced control types form the fundamentals every architecture decision uses.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →