◇ OpenCyber Academy
Engineering · Chapter 3 · English

Chapter 3 — Physics for computing

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Physics for computing

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Signals and noise"]
  N2["3.2 Sampling"]
  N3["3.3 Energy and heat"]
  N4["3.4 Physical failures"]
  N5["3.5 Time and clocks"]
  N6["3.6 Case link"]
  N7["Electromagnetic and physical security"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Signals and noise"]
  N2["3.2 Sampling"]
  N3["3.3 Energy and heat"]
  N4["3.4 Physical failures"]
  N5["3.5 Time and clocks"]
  N6["3.6 Case link"]
  N7["Electromagnetic and physical security"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Signals and noise]
    |
    v
[3.2 Sampling]
    |
    v
[3.3 Energy and heat]
    |
    v
[3.4 Physical failures]
    |
    v
[3.5 Time and clocks]
    |
    v
[3.6 Case link]
    |
    v
[Electromagnetic and physical security]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) relate physical limits to sensor and storage design; (2) reason about signal, noise and sampling in telemetry; (3) estimate power and heat for SOC infrastructure; (4) recognise physical failure modes.

3.1 Signals and noise

Physics describes measurements as signal plus noise. Telemetry is similar: real attack activity is the signal, normal activity is the noise. A sensor that samples too rarely misses short signals, just as a slow oscilloscope misses fast pulses.

The ratio between the two decides how easy detection is. A loud attack against a quiet network stands out; a quiet attack hidden in busy normal traffic does not. Defenders can improve the ratio by collecting fields that separate the two, such as process parentage, rather than simply collecting more data that adds noise as quickly as signal.

3.2 Sampling

If a network sensor exports flow summaries every 5 minutes, a 20-second burst appears smeared into one record. Faster sampling resolves bursts but multiplies data volume. Engineering chooses a rate that resolves the signals of interest at acceptable cost.

The smearing is an averaging effect: the burst's intensity spread across five minutes looks like a mild rise rather than a spike. A rule tuned on per-minute data would then miss it. Amara compares the portal's per-request web logs with the five-minute flow summaries for the same period and sees the burst's pace clearly in one, while the other holds only a single large record.

3.3 Energy and heat

A SIEM cluster draws electrical power and turns it into heat. Doubling ingestion may need more servers, more cooling and more rack space. Physical capacity limits how much telemetry a SOC can keep.

Each server's power use turns almost entirely into heat that cooling must remove, so power and cooling budgets grow together. A data room with fixed cooling can reach its limit before the budget for servers runs out. Planning ingestion growth therefore involves facilities staff, not just the SIEM team, and long retention may be cheaper on slower, cooler archive storage.

3.4 Physical failures

Disks wear out, power supplies fail, fibres get cut. Monitoring infrastructure needs redundancy; a single failed collector can silence a whole site's logs.

A silent collector is worse than a noisy one, because the absence of logs can look like the absence of attacks. SOCs therefore monitor the monitoring: each source has an expected volume, and a sharp drop raises its own alert. Redundant collectors, dual power supplies and separate network paths reduce the chance that one failure blinds a whole site.

3.5 Time and clocks

Clocks drift because oscillators are physical devices. NTP keeps them close, but drift of seconds can reorder events across hosts. NIST SP 800-92 stresses time synchronisation in log management.

Order matters in investigations: did the login come before the file access or after? Network Time Protocol adjusts each clock against reference servers, typically keeping drift to milliseconds on a healthy network. Logs should record times in UTC with the zone stated, so events from different regions can be compared without conversion mistakes.

3.6 Case link

The Lindqvist portal logs come from three web servers. One server's clock is 4 seconds fast, so failures logged there appear slightly later than they happened.

Four seconds sounds trivial, but during a burst of several attempts per second it reorders events across servers. A success on another server could appear to happen before the failures that preceded it. Amara notes the offset in her analysis and corrects for it rather than editing the logs, and the operations team fixes the server's time synchronisation.

Electromagnetic and physical security

Physical access to network closets lets someone add a tap or unplug a sensor. Sensors, collectors and their cabling are part of the monitored estate and need locks and tamper alarms.

Worked example

Amara compares the portal's 5-minute flow summaries with per-request web logs. Flows show one large record for 203.0.113.0/24 at 10:05; the web logs show 600 attempts spread over 40 seconds inside it. She notes that flow data detected the burst but could not show its pace.

Synthetic case. Servers and figures are invented.

Errors and limits

Physical analogies help intuition but telemetry noise is not random in the physical sense; it follows business patterns.

Exercises

Synthesis

Physical limits on sampling, clocks and infrastructure shape what telemetry a SOC can collect and trust.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →