Chapter 40 — Verification laboratory II
Lesson map
Lesson 40 published. Map, example, EX118.
flowchart TD
N0["Learning outcomes"]
N1["40.1 Flow matrix as specification"]
N2["40.2 Automated comparison"]
N3["Lab — Firewall rules against the flow matrix"]
N4["40.3 Reporting deviations"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX118"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["40.1 Flow matrix as specification"]
N2["40.2 Automated comparison"]
N3["Lab — Firewall rules against the flow matrix"]
N4["40.3 Reporting deviations"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX118"]
[Learning outcomes]
|
v
[40.1 Flow matrix as specification]
|
v
[40.2 Automated comparison]
|
v
[Lab — Firewall rules against the flow matrix]
|
v
[40.3 Reporting deviations]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX118]
Learning outcomes
You will (1) verify network segmentation against an approved flow matrix; (2) automate configuration verification; (3) report deviations with evidence.
40.1 Flow matrix as specification
The back office's network design defines an approved flow matrix: which zones may connect to which, on which ports. In Verification Laboratory II, Sofia verifies that the implemented firewall rules match the matrix. A rule allowing a flow not in the matrix is excess access; a matrix flow without a rule is a broken function. She exports synthetic firewall rules from the lab environment and compares them programmatically with the matrix, rather than reading hundreds of rules by eye, which is slow and error-prone. The script itself is reviewed like any other control.
40.2 Automated comparison
Sofia's script reads the approved matrix and the exported rules, normalises them and computes differences. The lab below runs on synthetic data and reports two excess rules, one allowing staff workstations to reach the journey database directly and one an any-to-any rule left from testing, and one missing flow from ingestion to the logging collector. The comparison runs automatically after every change, turning a one-time audit into continuous verification. She stores outputs as evidence linked to change tickets, so auditors can see when each deviation appeared and when it was closed.
Lab — Firewall rules against the flow matrix
# Compare synthetic firewall rules with an approved zone flow matrix.
approved = {("validators", "ingestion", 443), ("ingestion", "journey-db", 5432), ("ingestion", "logging", 6514),
("reporting", "journey-db", 5432), ("admin-jump", "ingestion", 22)}
rules = ["validators ingestion 443", "ingestion journey-db 5432", "reporting journey-db 5432",
"admin-jump ingestion 22", "staff-ws journey-db 5432", "any any any"]
impl = {(a, b, int(p) if p != "any" else p) for a, b, p in (r.split() for r in rules)}
for x in sorted(impl - approved, key=str): print("EXCESS ", *x)
for x in sorted(approved - impl, key=str): print("MISSING", *x)
Run with python3 lab_flows.py. Verified output:
EXCESS any any any
EXCESS staff-ws journey-db 5432
MISSING ingestion logging 6514
40.3 Reporting deviations
Each deviation becomes a finding with the rule, the matrix entry it violates, the risk and a proposed fix. The any-to-any rule is critical because it defeats segmentation entirely; the workstation-to-database rule is high, recreating the bypass found in chapter 22; the missing logging flow is medium because it silently weakens detection. Sofia's report also states what the verification covers: rule configuration, not runtime behaviour, so a follow-up test sends synthetic traffic to confirm enforcement. Verification evidence is strongest when configuration checks and behavioural tests agree.
Worked example
Sofia compares synthetic firewall rules with the approved flow matrix, finds two excess rules and one missing flow, rates them and adds behavioural tests.
Synthetic case. Zones, rules and the matrix are synthetic.
Errors and limits
Configuration exports may not reflect rules in effect. Matrices must be kept current or verification checks the wrong target.
Exercises
- EX118 — Excess versus missing. What is the difference between an excess rule and a missing flow? Rubric: 3 = excess allows unapproved access; missing breaks an approved function;; 2 = both;; 1 = same;; 0 = none.
- EX119 — Lab deviations. Which deviations did the lab report? Rubric: 3 = excess staff-to-journey-db and any-to-any; missing ingestion-to-logging;; 2 = three;; 1 = one;; 0 = none.
- EX120 — Coverage statement. What does configuration verification not cover? Rubric: 3 = runtime enforcement behaviour;; 2 = runtime;; 1 = everything covered;; 0 = none.
Synthesis
Automated comparison of configurations with approved flows turns segmentation into continuously verified architecture.
Continue studying — chapter 40 of 50
← Chapter 39 (draft) · Course chapter index · Chapter 41 (draft) →