Chapter 18 — Security architecture | Engineering Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Zones"]
  N2["18.2 Conduits"]
  N3["18.3 Depth"]
  N4["18.4 Enforcement points"]
  N5["18.5 Analyst workstations"]
  N6["Practice note — Architecture verification"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Zones"]
  N2["18.2 Conduits"]
  N3["18.3 Depth"]
  N4["18.4 Enforcement points"]
  N5["18.5 Analyst workstations"]
  N6["Practice note — Architecture verification"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Zones]
    |
    v
[18.2 Conduits]
    |
    v
[18.3 Depth]
    |
    v
[18.4 Enforcement points]
    |
    v
[18.5 Analyst workstations]
    |
    v
[Practice note — Architecture verification]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) place Lantern in BEN's zones and conduits; (2) design trust boundaries between IT, OT and partner networks; (3) apply defence in depth to an intelligence platform; (4) choose where indicators are enforced.

18.1 Zones

BEN separates corporate IT, the SOC zone, a DMZ for external exchanges and OT zones for substations. Lantern's collectors live in the DMZ; its store and analyst interface in the SOC zone; nothing of Lantern runs in OT.

Keeping Lantern out of the OT zones means a compromise of the platform does not land an attacker next to substation equipment. Its influence on OT reaches only through block lists that pass approval. Collectors sit in the DMZ because they talk to outside servers, which makes them the components most exposed to hostile input.

18.2 Conduits

Data flows from DMZ collectors to the SOC store through one inspected conduit. Block lists flow from the SOC to IT firewalls automatically and to OT firewalls through an approval service. Each conduit has an owner and a rule set.

A single conduit is easier to inspect and log than many scattered connections. Kofi's flow checks compare observed traffic with this list, so any new path between zones shows up as a finding. The approval service for OT is itself a conduit with its own owner in network operations.

18.3 Depth

Network segmentation, mutual TLS between components, signed internal messages, role-based access for analysts and audit logging provide independent layers. Compromise of a collector should not yield the store.

Kofi checked this by asking what an attacker on a collector could do. They could read the collector's own configuration and send messages to the store, but those messages must be signed with a key the collector holds only in a restricted service. A forged message would fail checks and be logged.

18.4 Enforcement points

Indicators can be enforced at DNS resolvers, web proxies, firewalls and endpoint agents. Each has different collateral risk: DNS blocks a name precisely; a firewall block on a shared address affects many sites.

Kofi's routing rule sends each indicator to the most precise point that can act on it. Domains go to DNS resolvers, full web addresses go to the proxy, and only addresses with no known shared use go to firewalls. File hashes go to endpoint agents. The choice is recorded with the block, which helps when someone asks why a site was unreachable.

18.5 Analyst workstations

Analysts open suspicious reports and samples. Their workstations need isolation from production systems and a separate browsing environment for OSINT research to avoid exposing BEN's identity.

When an analyst visits a suspect site from BEN's network, the site's operator may see an address registered to an energy company and learn they are being watched. Kofi's design gives analysts a separate research environment with an unattributed connection and no access to the SOC zone. Files downloaded there are moved to the analysis sandbox through a controlled transfer, never opened on the main workstation.

Practice note — Architecture verification

Kofi verifies the diagram against reality with flow logs: every observed connection between zones must match an approved conduit. Unexpected flows become findings. This catches the shortcuts that appear during incidents and are never removed. Findings are tracked until the stray flow is either approved through change control or removed.

Worked example

An architecture review finds that the enrichment service in the SOC zone calls external lookup APIs directly. Kofi moves outbound enrichment calls to a DMZ proxy so that the SOC zone has no direct internet access.

Synthetic case. The review finding is invented.

Errors and limits

Diagrams drift from reality; verify flows with network evidence. OT design must involve OT engineers.

Exercises

EX052 — OT placement. Why does no Lantern component run inside OT zones? Rubric: 3 = keep OT minimal/isolated; reduce attack surface and safety risk; 2 = partial; 1 = should run in OT; 0 = none.
EX053 — Enforcement pick. For a malicious domain on shared hosting, which enforcement point is preferred and why? Rubric: 3 = DNS/proxy domain block; precise, avoids collateral; 2 = point only; 1 = firewall IP block; 0 = none.
EX054 — Enrichment egress. What risk did moving enrichment calls to a DMZ proxy reduce? Rubric: 3 = SOC zone direct internet exposure/exfil path; 2 = vague; 1 = performance; 0 = none.

Synthesis

Zone the platform, control conduits, layer defences, enforce precisely and keep analysts' research separate.

Continue studying — chapter 18 of 50

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →