Chapter 25 — Design studio I
Lesson map
Lesson 25 published. Map, example, EX073.
flowchart TD
N0["Learning outcomes"]
N1["25.1 The studio problem"]
N2["25.2 Generating alternatives"]
N3["25.3 Criteria"]
N4["25.4 Studio critique"]
N5["25.5 Iteration"]
N6["25.6 Documentation"]
N7["25.7 Teamwork"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX073"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["25.1 The studio problem"]
N2["25.2 Generating alternatives"]
N3["25.3 Criteria"]
N4["25.4 Studio critique"]
N5["25.5 Iteration"]
N6["25.6 Documentation"]
N7["25.7 Teamwork"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]
[Learning outcomes]
|
v
[25.1 The studio problem]
|
v
[25.2 Generating alternatives]
|
v
[25.3 Criteria]
|
v
[25.4 Studio critique]
|
v
[25.5 Iteration]
|
v
[25.6 Documentation]
|
v
[25.7 Teamwork]
|
v
[Worked example] --> [Exercise EX073]
Learning outcomes
You will (1) work in a team on an open-ended SOC design problem; (2) generate and compare alternative designs; (3) present a design with rationale; (4) respond to critique in a studio setting.
25.1 The studio problem
Teams design monitoring for Lindqvist's depot networks, where handheld scanners and old workstations cannot run agents. The design must detect unusual connections from depots into business systems.
Unusual connections might include a scanner talking to a finance server, or a depot workstation reaching systems it has never used before. Without agents, the design must rely on network observation. Teams also need to consider that depots differ in size and connectivity, so one design must work for a small rural depot and a large hub.
25.2 Generating alternatives
Amara's team lists three options: network flow monitoring at the depot-to-business boundary; a network detection sensor with protocol analysis; and tightening firewall rules with logging of denied connections.
Listing several options before evaluating any prevents the first idea from becoming the only one. The three differ in kind: one observes flows, one inspects content, one restricts traffic and records refusals. Each has different costs and blind spots, which the criteria comparison will bring out, and a hybrid may emerge once the pieces are understood.
25.3 Criteria
They compare options on visibility, cost, operational load, privacy and failure modes, using a weighted table.
Visibility asks what each option can see; cost includes hardware, licences and staff time; operational load asks who maintains it; privacy considers whether staff traffic content is collected; failure modes ask what happens when it breaks. Weights are agreed before scoring, and each score cites evidence such as a vendor datasheet or a measurement. Privacy carries a high weight because depot staff use the same network for personal messages during breaks, and the company's monitoring policy limits content collection.
25.4 Studio critique
Each team presents for ten minutes; peers and staff challenge assumptions. The studio values clear reasoning over polished slides.
Critique is aimed at the design, not the people. Typical challenges are 'what happens if the sensor fails?' or 'how will you know the rules work?'. Slides with impressive diagrams but no reasoning score poorly. Staff note recurring weaknesses across teams and address them in the next teaching session. Feedback is written on cards and handed to each team after its slot, so comments are not lost and quieter students can contribute too.
25.5 Iteration
After critique, teams revise. Amara's team learns that the boundary firewall already logs allowed and denied flows; combining firewall logs with a small number of allow rules is cheaper than a new sensor.
The finding came from asking depot IT staff during critique, which shows the value of involving people who know the existing systems. Using the firewall's existing logs costs almost nothing in hardware. Tight allow rules shrink normal traffic to a short list, so any denied or unexpected flow stands out clearly in the logs.
25.6 Documentation
The final design includes a diagram, data flows, requirements met, risks and a test plan.
The diagram shows where logs come from and where they go; data flows give formats and volumes; requirements met link back to the brief; risks state what could go wrong; the test plan shows how the design will be proved. A reviewer who missed the presentation should understand the design from the document alone. Amara's team limits the document to six pages. Appendices hold detail.
25.7 Teamwork
Roles rotate: presenter, scribe, critic. Everyone explains every part.
Rotating roles stops one confident member from presenting everything while others stay silent. The scribe records decisions and critique; the critic looks for weaknesses before outsiders do. Requiring everyone to explain every part means the staff can question any member, which reveals whether understanding is shared or held by one person. At the end, each member writes a short note on what they contributed and what they learned from another member, which staff read alongside the team's design.
Privacy in the design
Depot devices are used by drivers and warehouse staff. The design logs connection metadata only, not content, and keeps it for 30 days, which the privacy officer reviews and approves. Teams include such reviews in the plan rather than adding them at the end.
Worked example
The team's final design: restrict depot-to-business traffic to five required services, log all denied attempts, alert when a depot device attempts a new destination more than three times in an hour, and review weekly. Estimated cost: configuration time only. Main risk: firewall log feed failure, covered by heartbeat monitoring.
Synthetic case. The studio and designs are invented.
Errors and limits
Studio designs are untested; chapter 30's laboratory verifies them.
Exercises
- EX073 — Three options. List the three depot monitoring options considered. Rubric: 3 = flow monitoring, network sensor, firewall tightening with logging; 2 = two; 1 = one; 0 = none.
- EX074 — Critique outcome. What did critique change in the design? Rubric: 3 = used existing firewall logs; cheaper than new sensor; 2 = partial; 1 = vague; 0 = none.
- EX075 — Final design. Summarise the final design and its main risk. Rubric: 3 = 5 services allowed, denied logged, alert on repeated new destinations, weekly review; feed failure risk; 2 = partial; 1 = vague; 0 = none.
Synthesis
Studios teach design through alternatives, criteria and critique; the cheapest good design often reuses what exists.
Continue studying — chapter 25 of 50
← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →