Chapter 45 — Independent design review | Engineering Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 45 — Independent design review

Lesson map

Lesson 45 published. Map, example, EX133.

flowchart TD
  N0["Learning outcomes"]
  N1["45.1 Preparing"]
  N2["45.2 Concerns raised"]
  N3["45.3 Recording outcomes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX133"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["45.1 Preparing"]
  N2["45.2 Concerns raised"]
  N3["45.3 Recording outcomes"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX133"]

[Learning outcomes]
    |
    v
[45.1 Preparing]
    |
    v
[45.2 Concerns raised]
    |
    v
[45.3 Recording outcomes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX133]

Learning outcomes

You will (1) prepare a design for independent review; (2) respond to reviewers' concerns; (3) record review outcomes.

45.1 Preparing

Before building, Nadia submits her monitoring design for independent review by an engineer from another utility and Ardwell's internal auditor. She prepares a short design document: purpose, scope, architecture, data flows, controls covered, failure modes and how evidence integrity is protected. She includes her assumptions explicitly, such as that source systems report accurate timestamps. Independent review works best when reviewers can see what the designer assumed, because hidden assumptions are where reviewers add most value. Stating the timestamp assumption, for example, invites reviewers to ask what happens if a source clock is wrong.

45.2 Concerns raised

The auditor asks whether automated evidence could be manipulated by the people whose controls it monitors. The engineer asks what happens when a source system is unavailable: is a missing report treated as a pass or a failure? Nadia realises her design treated silence as success. She changes it so missing evidence raises an alert and counts as a failed collection. She also adds hashing of evidence files and storage in a location the monitored teams cannot alter. Treating missing evidence as a failure closes the gap where an unavailable source would have looked like a passing control.

45.3 Recording outcomes

Nadia records each concern, her response and whether reviewers accepted it. Two minor concerns about dashboard wording are deferred to a later release with reasons. The record goes into the project archive and later into her evidence dossier. She learns that review records show auditors and examiners not only the final design but how it improved, and that a design able to absorb criticism is stronger than one that never faced any. The deferred wording changes are recorded with reasons so that examiners can see they were weighed, not ignored.

Worked example

Nadia prepares a review pack with assumptions, fixes silence-as-success and evidence integrity issues and records outcomes.

Synthetic case. Reviewers and design are synthetic.

Errors and limits

Reviewers have limited time. Deferred items can be forgotten.

Exercises

EX133 — Assumption example. Which assumption did Nadia state explicitly? Rubric: 3 = source systems report accurate timestamps;; 2 = timestamps;; 1 = vague;; 0 = none.
EX134 — Silence fix. How was the silence-as-success flaw fixed? Rubric: 3 = missing evidence raises an alert and counts as a failed collection;; 2 = fail closed;; 1 = pass;; 0 = none.
EX135 — Integrity measures. What protects evidence from manipulation? Rubric: 3 = hashing and storage the monitored teams cannot alter;; 2 = hashing;; 1 = vague;; 0 = none.

Synthesis

Independent review exposes hidden assumptions and strengthens designs when outcomes are recorded.

Continue studying — chapter 45 of 50

← Chapter 44 (draft) · Course chapter index · Chapter 46 (draft) →