◇ OpenCyber Academy
Engineering · Chapter 16 · English

Chapter 16 — Systems engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 16 — Systems engineering

Lesson map

Lesson 16 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["16.1 Boundary and stakeholders"]
  N2["16.2 Concept of operations"]
  N3["16.3 Interface control"]
  N4["16.4 Life cycle"]
  N5["16.5 Trade studies"]
  N6["Practice note — Stakeholder map"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["16.1 Boundary and stakeholders"]
  N2["16.2 Concept of operations"]
  N3["16.3 Interface control"]
  N4["16.4 Life cycle"]
  N5["16.5 Trade studies"]
  N6["Practice note — Stakeholder map"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]

[Learning outcomes]
    |
    v
[16.1 Boundary and stakeholders]
    |
    v
[16.2 Concept of operations]
    |
    v
[16.3 Interface control]
    |
    v
[16.4 Life cycle]
    |
    v
[16.5 Trade studies]
    |
    v
[Practice note — Stakeholder map]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) define a system boundary and its stakeholders; (2) write a concept of operations for a CTI platform; (3) manage interfaces with an interface control document; (4) plan the life cycle from concept to retirement.

16.1 Boundary and stakeholders

Lantern's boundary includes collectors, store, enrichment, analyst interface and dissemination. Outside it: partner servers, BEN's firewalls and SIEM, the sector ISAC. Stakeholders include SOC analysts, OT engineers, the privacy officer, partners and executives.

Drawing the line tells the team what they control and what they can only influence. A firewall outside the boundary may reject a rule Lantern sends, and Lantern must cope with that rather than assume success. Kofi found one stakeholder missing from the first draft: the network operations team, who own the firewalls and must agree to every change in how rules arrive.

16.2 Concept of operations

A ConOps describes, in operators' words, how the system is used: "At 07:00 the duty analyst reviews overnight high-confidence indicators; automatic blocks apply to IT segments only; OT blocks await approval." It is the reference for requirements.

Kofi wrote the first draft by sitting with the duty analyst for a morning and writing down what she did, then asking what she wished the system did instead. Operators corrected several steps when they read it, including the order in which they check overnight alerts. Requirements written later can each be traced to a sentence in this description, which shows why they exist.

16.3 Interface control

Each interface — TAXII 2.1 with partners, the SIEM API, the firewall push — has an interface control document: data formats, rates, authentication, error handling and owners on both sides.

Without such a document, each side assumes the other handles errors. Kofi found that the SIEM team expected Lantern to retry failed deliveries while Lantern expected the SIEM to request missing data. Writing the interface down exposed the gap before an outage did. Each document names a contact on both sides and is reviewed whenever either system changes its format or limits.

16.4 Life cycle

Concept, requirements, design, build, verification, validation, operation and retirement. Retirement matters in CTI: decommissioning a feed means telling the partner, deleting retained restricted data and removing credentials.

Kofi's plan for each feed includes its end: who tells the partner, which stored records must go under the agreement, which credentials are revoked and which firewall rules derived from the feed are reviewed. When BEN later dropped a low-value commercial feed, the plan turned what could have been a messy week into a checklist finished in two days.

16.5 Trade studies

Build versus buy, on-premises versus cloud, open-source versus commercial threat-intelligence platforms: trade studies weigh cost, control, integration and risk with explicit criteria.

Kofi's study for the platform listed criteria first and weighted them with the CTI lead before scoring any option, so that the preferred answer could not shape the weights. Integration with BEN's existing SIEM and the ability to keep restricted partner data on BEN's own servers carried the most weight. The scores and the reasoning were kept, so the decision can be revisited when circumstances change rather than argued from memory.

Practice note — Stakeholder map

Kofi draws a map of stakeholders with their interest and influence. The privacy officer has high influence and a narrow interest; partners have moderate influence and a strong interest in reciprocity. The map guides who reviews which documents and avoids late surprises. Kofi keeps the ConOps to four pages so that operators actually read and correct it.

Worked example

Kofi writes the ICD for the firewall push: STIX indicators converted to vendor rule format; maximum 5,000 rules per push; mutual TLS; failure returns error and keeps the previous rule set; owners — Lantern team and network operations.

Synthetic case. The ICD values are invented.

Errors and limits

Systems engineering paperwork that nobody reads is waste; keep documents short and used. Missing stakeholders surface late and expensively.

Exercises

Synthesis

Draw the boundary, speak the operators' language, control interfaces, and plan retirement from day one.

Continue studying — chapter 16 of 50

← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →