Chapter 33 — Security architecture and engineering: safety and resilience | Engineering Security architecture and engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 33 published. Map, example, EX097.

flowchart TD
  N0["Learning outcomes"]
  N1["33.1 Three related goals"]
  N2["33.2 Resilience techniques"]
  N3["33.3 Graceful degradation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX097"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["33.1 Three related goals"]
  N2["33.2 Resilience techniques"]
  N3["33.3 Graceful degradation"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX097"]

[Learning outcomes]
    |
    v
[33.1 Three related goals]
    |
    v
[33.2 Resilience techniques]
    |
    v
[33.3 Graceful degradation]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX097]

Learning outcomes

You will (1) distinguish security, safety and resilience goals; (2) apply resilience techniques from systems-engineering guidance; (3) design for graceful degradation under attack.

33.1 Three related goals

Security protects against intentional harm, safety protects people from physical harm whatever the cause, and resilience is the ability to anticipate, withstand, recover from and adapt to adverse conditions. In transit systems they overlap. A ransomware attack on the operations centre is a security event that may become a safety issue if passenger information fails during disruptions. Sofia learns that the three communities use different methods and vocabularies, and that architects must bring them together, for example by inviting safety engineers to threat-modelling sessions for systems that affect passengers or vehicles.

33.2 Resilience techniques

NIST SP 800-160 Vol. 1 Rev. 1 links resilience to engineering trustworthy systems, and SP 800-160 Vol. 2 Rev. 1 describes cyber-resiliency techniques such as redundancy, diversity, segmentation, adaptive response and non-persistence, each with guidance on when it helps. Sofia applies several to Corvia's operations centre: segmentation to contain spread, offline backups to recover, a diverse backup communication channel for drivers and pre-planned manual operating procedures. She writes each technique beside the adverse condition it addresses. Resilience planning assumes that prevention will sometimes fail and asks how the mission continues anyway, and which people must act when it does.

33.3 Graceful degradation

Sofia designs degradation levels for the fare system. Level one: central back office unavailable, validators continue offline with cached tariffs and deny lists. Level two: validators unavailable, inspectors accept visual proof and fares are suspended. Level three: operations centre compromised, services run on manual timetables with radio communication. Each level has a trigger, a decision maker and a return procedure. Rehearsing these levels shows staff that a cyber incident need not stop the trams, which reduces pressure to pay ransoms or rush unsafe restorations.

Worked example

Sofia separates security, safety and resilience goals, maps four resilience techniques to adverse conditions and defines three degradation levels with triggers and owners.

Synthetic case. Degradation levels and procedures are synthetic; SP 800-160 Vol. 1 Rev. 1 and Vol. 2 Rev. 1 are real.

Errors and limits

Manual procedures decay without practice. Degradation may itself create fraud opportunities that need monitoring.

Exercises

EX097 — Resilience definition. Define resilience in this chapter's terms.
Show marking criteria
Rubric: 3 = ability to anticipate, withstand, recover from and adapt to adverse conditions;; 2 = three parts;; 1 = security only;; 0 = none.
EX098 — Diverse channel. Which resilience technique does a backup driver communication channel represent?
Show marking criteria
Rubric: 3 = diversity or redundancy of communication;; 2 = diversity;; 1 = segmentation;; 0 = none.
EX099 — Ransom pressure. How do rehearsed degradation levels reduce ransom pressure?
Show marking criteria
Rubric: 3 = staff know services can continue manually, so there is less urgency to pay;; 2 = continuity;; 1 = vague;; 0 = none.

Synthesis

Resilient architecture assumes prevention can fail and designs safe, rehearsed ways for the mission to continue.

Continue studying — chapter 33 of 50

← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →