Chapter 18 — Security architecture
Lesson map
Lesson 18 published. Map, example, EX052.
flowchart TD
N0["Learning outcomes"]
N1["18.1 Layers"]
N2["18.2 Defence in depth"]
N3["18.3 Firmware resilience"]
N4["18.4 Application control"]
N5["18.5 Trade-offs"]
N6["Mapping to standards"]
N7["Single points of failure"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX052"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["18.1 Layers"]
N2["18.2 Defence in depth"]
N3["18.3 Firmware resilience"]
N4["18.4 Application control"]
N5["18.5 Trade-offs"]
N6["Mapping to standards"]
N7["Single points of failure"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]
[Learning outcomes]
|
v
[18.1 Layers]
|
v
[18.2 Defence in depth]
|
v
[18.3 Firmware resilience]
|
v
[18.4 Application control]
|
v
[18.5 Trade-offs]
|
v
[Mapping to standards]
|
v
[Single points of failure]
|
v
[Worked example] --> [Exercise EX052]
Learning outcomes
You will (1) design layered controls for public PCs; (2) place controls at firmware, OS, application and network layers; (3) explain defence in depth.
18.1 Layers
Firmware: Secure Boot and firmware password. OS: standard users, minimal services, disk encryption. Application: allowlist. Data: nightly restore of patron area. Network: segmentation. Monitoring: event logs and restore alerts.
Mateo writes the layers as a table with what each stops and what it depends on. The firmware layer protects the boot of everything above it. The monitoring layer watches the others. Writing them out showed that the data layer, the nightly restore, does the most work, which the worked example discusses with Dr Novak.
18.2 Defence in depth
If one layer fails, others still protect. If the allowlist misses a program, the nightly restore removes it.
Mateo tested this on a lab PC by deliberately adding a program to the allowlist by mistake and installing it in the patron area. The program ran that day, as the allowlist now permitted it, but was gone after the overnight restore. The test shows the layers working together, and also shows the limit: during that one day, the mistake was live. Layers reduce harm; they do not remove the need to get each one right.
18.3 Firmware resilience
NIST SP 800-193 sets principles for protecting, detecting and recovering firmware; SP 800-147 gives BIOS protection guidelines for update authentication.
For Fernhill the practical meaning is that firmware updates must come signed from the vendor and be checked before they are applied, that firmware settings are protected by a password, and that a damaged firmware can be detected and restored from a known-good copy. Mateo checks which of these the existing PC models support. Older models lacking recovery features are listed for replacement first.
18.4 Application control
Microsoft documents application control for Windows, allowing only approved software to run.
The documented approach lets Fernhill define which programs may run by publisher, path or file hash, and blocks everything else. Mateo starts the allowlist from the image contents list and adds accessibility tools after testing with patrons who use them. Rules are first run in audit mode, which logs what would have been blocked, so the team can find missing entries before enforcing. Enforcement begins only after a week with no unexpected audit entries.
18.5 Trade-offs
More layers add complexity and maintenance. The design keeps each layer simple.
Each layer needs its own maintenance: firmware passwords to manage, allowlist entries to review, segment rules to update. Mateo estimated the weekly hours for each and checked them against Marta's team's time, since a layer that nobody has time to maintain drifts until it no longer protects. He chose standard tools that Fernhill's staff could learn, rather than more powerful ones they would struggle to run. The estimate is reviewed every year.
Mapping to standards
Mateo maps each layer to recognised guidance. Firmware controls map to NIST SP 800-147 and SP 800-193. OS hardening maps to the CIS Benchmarks, Microsoft security baselines and NIST SP 800-123's principles. Application control maps to CIS Controls v8 safeguards on allowlisting authorised software. Data recovery maps to CIS Controls v8 data recovery safeguards. Monitoring maps to NIST SP 800-92 on log management.
This mapping helps Fernhill's auditors and shows that the design is not invented from scratch.
Single points of failure
The restore server and signing keys are single points of failure; later chapters add local copies and key protection.
Dependencies between layers
If firmware were changed, the boot chain could load an altered system, and restore might not run correctly. This is why firmware and boot protections are must-haves.
Worked example
Dr Novak asks which layer matters most. Mateo answers that the nightly restore is the backbone, because it corrects many failures of other layers, but it depends on firmware and boot protection to ensure the restore itself is trustworthy.
Synthetic case. Synthetic.
Errors and limits
Layers that depend on each other can fail together; identify dependencies.
Exercises
- EX052 — Layer list. List the layers and one control each. Rubric: 3 = firmware, OS, app, data, network, monitoring; 2 = five; 1 = three; 0 = none.
- EX053 — Firmware guidance. Which NIST publications cover firmware? Rubric: 3 = SP 800-193, SP 800-147; 2 = partial; 1 = vague; 0 = none.
- EX054 — Backbone. Why is restore the backbone? Rubric: 3 = corrects other layer failures; 2 = partial; 1 = vague; 0 = none.
Synthesis
Layered controls protect even when one layer fails.
Continue studying — chapter 18 of 50
← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →