Chapter 23 — Systems, endpoints and hardware security: threat and failure analysis
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Scenarios"]
N2["Lab — Lab — scenario ranking"]
N3["23.2 Reading the ranking"]
N4["23.3 Linking to requirements"]
N5["23.4 Coverage"]
N6["Reasoning for ratings"]
N7["No attack detail"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Scenarios"]
N2["Lab — Lab — scenario ranking"]
N3["23.2 Reading the ranking"]
N4["23.3 Linking to requirements"]
N5["23.4 Coverage"]
N6["Reasoning for ratings"]
N7["No attack detail"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Scenarios]
|
v
[Lab — Lab — scenario ranking]
|
v
[23.2 Reading the ranking]
|
v
[23.3 Linking to requirements]
|
v
[23.4 Coverage]
|
v
[Reasoning for ratings]
|
v
[No attack detail]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) list misuse and failure scenarios; (2) rank by likelihood and impact; (3) link scenarios to requirements.
23.1 Scenarios
Mateo lists seven scenarios, from personal files left behind to a staff laptop lost unencrypted, rating likelihood and impact from 1 to 5.
Each scenario describes something that could go wrong and who would be affected, without describing how anyone would cause it. Mateo drew them from Fernhill's incident records, staff interviews and the threats listed earlier. The scale is coarse on purpose, because finer numbers would suggest a precision the evidence cannot support. Each rating is agreed with Marta, and disagreements are noted rather than averaged away.
Lab — Lab — scenario ranking
"""Rank synthetic failure and misuse scenarios by likelihood x impact (stdlib only)."""
sc = [("patron leaves personal files on PC", 5, 3), ("unauthorised software installed by patron", 4, 4),
("USB device carries malware", 3, 4), ("firmware update fails and bricks PC", 2, 4),
("restore job fails silently", 2, 5), ("staff laptop lost unencrypted", 1, 5), ("boot settings changed in firmware menu", 2, 3)]
for name, l, i in sorted(sc, key=lambda s: -s[1]*s[2]):
print(f"{l*i:2d} L{l} I{i} {name}")
Run with python3 lab_scenarios.py. Verified output:
16 L4 I4 unauthorised software installed by patron
15 L5 I3 patron leaves personal files on PC
12 L3 I4 USB device carries malware
10 L2 I5 restore job fails silently
8 L2 I4 firmware update fails and bricks PC
6 L2 I3 boot settings changed in firmware menu
5 L1 I5 staff laptop lost unencrypted
23.2 Reading the ranking
Top: unauthorised software installed by a patron (16), personal files left behind (15), malware via USB (12), silent restore failure (10). Firmware update failure scores 8, boot settings changed 6, lost staff laptop 5.
The top two are close, and both are the problems that started the project. That agreement between the ranking and Fernhill's experience is a useful sanity check. Silent restore failure ranks fourth despite its high impact, because it should be rare; the next sections explain why it still gets a must-have requirement. Low scores still receive attention.
23.3 Linking to requirements
Software installs map to R5; files to R4; USB to R3; silent restore failure to R9; firmware update failure to firmware resilience; boot settings to R2; staff laptop to R8.
Mateo writes this mapping into the traceability table, so each scenario points to the requirements that reduce it and each requirement points back to the scenarios it addresses. When a scenario is re-rated after deployment, the table shows which requirement produced the change, and a requirement whose scenario disappears can be reviewed for removal.
23.4 Coverage
Every scenario has at least one requirement; silent restore failure, though lower ranked, has severe impact.
Coverage alone does not show that a requirement works, only that one exists. The verification plan supplies the evidence later. Silent restore failure is the case where ranking and priority differ. If it happened, every other control that relies on the restore would quietly stop working, and nobody would know. That is why the alert on restore failure is a must-have, even though the scenario sits in the middle of the list. Mateo records this reasoning beside the ranking.
Reasoning for ratings
Each rating carries one sentence of reasoning. For example, unauthorised software installs score likelihood 4 because staff report them weekly, and impact 4 because toolbars can capture what patrons type. Personal files score likelihood 5 because they occur daily, impact 3 because exposure is usually limited to the next user. Writing reasons lets Marta and Dr Novak challenge specific judgements.
The ratings are revisited after deployment to see which scenarios still occur.
No attack detail
Scenarios describe outcomes, not methods, keeping the analysis defensive.
Updating the analysis
After deployment, the team re-rates scenarios: personal files left behind drops to likelihood 1, because restore removes them nightly; unauthorised software drops to 1 after enforcement. Re-rating shows the design's effect in risk terms.
Including staff devices
Staff laptops are included because they connect to the same management server.
Worked example
Dr Novak asks why the lost laptop scores low. Mateo explains staff laptops rarely leave buildings and few exist, but impact is high, so R8 remains a must-have.
Synthetic case. Synthetic ratings.
Errors and limits
Scores are judgements; record reasons for each.
Exercises
- EX067 — Top three. Name the top three scenarios. Rubric: 3 = software install, files left, USB malware; 2 = two; 1 = one; 0 = none.
- EX068 — Silent failure. Why does silent restore failure matter despite rank? Rubric: 3 = impact 5; 2 = partial; 1 = vague; 0 = none.
- EX069 — Mapping. Which requirement addresses USB malware? Rubric: 3 = R3; 2 = partial; 1 = vague; 0 = none.
Synthesis
Rank scenarios and ensure each maps to a requirement.
Continue studying — chapter 23 of 50
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →