Chapter 26 — Systems, endpoints and hardware security: architecture alternatives
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Alternative A"]
N2["26.2 Alternative B"]
N3["26.3 Alternative C"]
N4["26.4 Criteria"]
N5["26.5 Choice"]
N6["Scoring alternatives"]
N7["Revisiting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Alternative A"]
N2["26.2 Alternative B"]
N3["26.3 Alternative C"]
N4["26.4 Criteria"]
N5["26.5 Choice"]
N6["Scoring alternatives"]
N7["Revisiting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Alternative A]
|
v
[26.2 Alternative B]
|
v
[26.3 Alternative C]
|
v
[26.4 Criteria]
|
v
[26.5 Choice]
|
v
[Scoring alternatives]
|
v
[Revisiting]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) compare alternative architectures; (2) evaluate trade-offs; (3) select with reasons.
26.1 Alternative A
Full disk reimage nightly from the network: strongest reset, but slow and network-heavy.
Every night each PC would download and write its entire disk from the server, removing any change anywhere on the system, not just in the patron area. Mateo estimated the traffic: three hundred full images each night would take most of the night on Eastgate's congested link and could still be running at opening. The security benefit is real, but the cost in time and network load is high, and a failure partway through leaves the PC unusable until it finishes.
26.2 Alternative B
Patron-area restore plus signed golden image updates monthly: faster, less traffic, relies on strong OS protection for system areas.
Only the area patrons can write to is reset each night, which takes minutes and uses little network traffic since the copy is held locally. The system areas stay as they are between monthly image updates, protected by standard user accounts, application control and Secure Boot. The weakness is that a change to the system area that got past those protections would persist until the next full update. Mateo notes that weakness explicitly so it can be addressed.
26.3 Alternative C
Thin clients with sessions hosted centrally: easier to manage but needs new hardware and server capacity.
Patrons would use simple devices that display a session running on servers, and the servers would be reset centrally. Management would be easier, since there would be fewer full computers to look after. Fernhill would need new devices for all three hundred seats, servers to host the sessions and a network able to carry them. Accessibility tools would also need testing in the hosted environment, where some behave differently. The option is attractive but not affordable this year.
26.4 Criteria
Security, restore time, network load, cost and accessibility.
Mateo agreed these five criteria with Marta before scoring any alternative, so the scoring could not be shaped around a favourite. Security covers how thoroughly each design resets a PC. Restore time and network load come from estimates checked against the pilot. Cost includes staff time as well as equipment. Accessibility asks whether patrons who rely on assistive tools can still use every PC. Each criterion has a short note explaining what a high and a low score mean.
26.5 Choice
B with a weekly full reimage: daily patron reset, weekly system reset, using existing hardware.
The weekly full reimage covers the weakness of alternative B: any change to system areas that got past the other controls lasts at most a week. It runs on Sunday nights, when all three branches are closed the next morning, so a slow reimage at Eastgate cannot delay opening. Mateo records the choice with the scores, the sensitivity check and the conditions under which it should be revisited, such as new hardware funding.
Scoring alternatives
Mateo scores each alternative from 1 to 5 on each criterion. A scores 5 on security but 2 on network load and 3 on restore time. B scores 4 on security, 4 on restore time and 4 on network load. C scores 4 on security but 1 on cost. B's total is highest, and a weekly full reimage raises its security score by resetting system areas too.
He shows the scoring table to Marta and notes that the scores are judgements, so the table supports discussion rather than replacing it.
Revisiting
The choice will be revisited when hardware is replaced, when C may become affordable.
Communicating the choice
The choice is explained to librarians in plain words: computers clear patron files every night and fully refresh once a week.
Sensitivity
Mateo checks whether changing one score would alter the choice. Only a large change in cost would favour C, so the decision is robust.
Agreement
Marta and Dr Novak agree with the choice.
Worked example
The board asks for the cost of C. Mateo estimates new hardware at a cost Fernhill cannot meet this year; C is recorded as a future option.
Synthetic case. Synthetic.
Errors and limits
Choosing on a single criterion hides costs elsewhere.
Exercises
- EX076 — Alternatives. Name the three alternatives. Rubric: 3 = full reimage, patron restore, thin clients; 2 = two; 1 = one; 0 = none.
- EX077 — Criteria. List the selection criteria. Rubric: 3 = security, time, network, cost, accessibility; 2 = four; 1 = two; 0 = none.
- EX078 — Choice. What was chosen? Rubric: 3 = B plus weekly full reimage; 2 = partial; 1 = vague; 0 = none.
Synthesis
Compare alternatives on several criteria and record the choice.
Continue studying — chapter 26 of 50
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →