◇ OpenCyber Academy
Engineering · Chapter 2 · English

Chapter 2 — Discrete mathematics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Discrete mathematics

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Sets of software"]
  N2["2.2 Logic for requirements"]
  N3["2.3 Graphs"]
  N4["2.4 Counting configurations"]
  N5["2.5 Proof habits"]
  N6["Applying it to the project"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Sets of software"]
  N2["2.2 Logic for requirements"]
  N3["2.3 Graphs"]
  N4["2.4 Counting configurations"]
  N5["2.5 Proof habits"]
  N6["Applying it to the project"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Sets of software]
    |
    v
[2.2 Logic for requirements]
    |
    v
[2.3 Graphs]
    |
    v
[2.4 Counting configurations]
    |
    v
[2.5 Proof habits]
    |
    v
[Applying it to the project]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) use sets, logic and graphs to describe endpoint configurations; (2) reason about allowlists as sets; (3) model a network of PCs as a graph.

2.1 Sets of software

The software allowed on a public PC forms a set A. The software actually executed during a week forms a set E. Anything in E but not in A, written E minus A, is unauthorised. This simple set difference is the core of application control, which Mateo will design later.

Mateo tried the idea on a week of synthetic records from one branch. The difference held a game installer and a toolbar, which matched what staff had reported. Writing the rule as a set operation also shows what it cannot do: a harmful program inside the approved set would not appear in the difference at all.

2.2 Logic for requirements

Requirements can be written as logical statements: "if a PC is public, then USB storage is disabled". Writing them precisely avoids ambiguity, such as whether staff PCs are included.

Mateo found that the first draft said only that USB storage must be disabled, without saying on which PCs. Rewritten as an implication with a clear condition, the rule could be checked by a program: for each PC, if it is marked public, the setting must be off. Staff laptops fall outside the condition, which is what Marta intended, and the record now says so explicitly.

2.3 Graphs

Fernhill's network can be drawn as a graph: PCs, switches and servers are nodes; network links are edges. A graph shows which PCs can reach each other. If public PCs can reach staff laptops directly, a problem on one could affect the other.

Mateo built the first graph from Fernhill's network documents and then checked it against switch configurations, as the errors note advises. He found one link the documents did not show. The graph also helps when planning changes: removing a single edge can separate the public PCs from staff devices entirely.

2.4 Counting configurations

With ten yes-or-no settings, there are 2 to the power 10, or 1,024, possible configurations. Only one is the approved baseline. Counting shows why drift is likely without automation: many ways to be wrong, one way to be right.

Mateo saw this in practice. Of the first twenty PCs he checked by hand, several had at least one setting that differed from the baseline, each in a different way. Nobody had made a deliberate change; small fixes and user actions had added up. Automated checks and nightly restores bring every PC back to the single approved combination.

2.5 Proof habits

Discrete mathematics trains careful reasoning: stating assumptions, checking edge cases and not generalising from a few examples.

Mateo applies these habits to the project's rules. When he claims that every public PC resets nightly, he asks what would make the claim false: a PC switched off overnight, a branch closed for a holiday, a new PC added without the restore tool. Each case becomes a test. A claim that holds only for the PCs he happened to check is not yet a rule, however many examples support it.

Applying it to the project

Mateo writes the first draft of the public PC rules in logical form: every public PC must run only software in A, must have USB storage disabled and must reset nightly. Writing them this way exposes a question nobody had asked: are the catalogue kiosks public PCs? Marta decides they are, so the rules apply to them too.

Worked example

Mateo draws Fernhill's network graph and finds that public PCs and staff laptops share one network segment at Eastgate. He records this as a design question: should public PCs be on their own segment, so the graph has no edge between them and staff devices?

Synthetic case. Synthetic network.

Errors and limits

A graph from documentation may miss links added later; verify against switch configurations.

Exercises

Synthesis

Sets, logic and graphs make endpoint rules and connections precise.

Continue studying — chapter 02 of 50

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →