◇ OpenCyber Academy
Engineering · Chapter 3 · English

Chapter 3 — Physics for computing

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Physics for computing

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Latency has a floor"]
  N2["3.2 Bandwidth and bulk feeds"]
  N3["3.3 Storage growth"]
  N4["3.4 Clocks"]
  N5["3.5 Power and heat"]
  N6["Practice note — Latency budgets"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Latency has a floor"]
  N2["3.2 Bandwidth and bulk feeds"]
  N3["3.3 Storage growth"]
  N4["3.4 Clocks"]
  N5["3.5 Power and heat"]
  N6["Practice note — Latency budgets"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Latency has a floor]
    |
    v
[3.2 Bandwidth and bulk feeds]
    |
    v
[3.3 Storage growth]
    |
    v
[3.4 Clocks]
    |
    v
[3.5 Power and heat]
    |
    v
[Practice note — Latency budgets]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) relate signal propagation and bandwidth to collection latency; (2) estimate storage growth for retained intelligence; (3) understand power and cooling as constraints on always-on platforms; (4) connect physical timing to timestamp accuracy.

3.1 Latency has a floor

Light in fibre travels about 200,000 km per second, so a round trip between continents costs tens of milliseconds before any processing. A TAXII 2.1 poll across an ocean will never be instant; engineers set polling intervals and timeouts with that floor in mind.

Kofi measured a poll from Lantern to a partner server on another continent and saw about a hundred milliseconds before the first byte arrived. That cost is fixed by distance. A timeout shorter than the floor fails every request, while one far longer hides real outages. He sets the timeout at several seconds and records each poll's duration, so a slow partner shows up in the logs instead of as missing data.

3.2 Bandwidth and bulk feeds

A bulk feed of 2 GB each night over a 100 Mbit/s link takes roughly 160 seconds at full rate, ignoring overheads. If the link is shared with operational traffic for substations, scheduling transfers away from peak use is a physical, not merely administrative, decision.

The worked example adds overhead and schedules the transfer at 02:00 for this reason. A large download during the day could compete with telemetry from substations, which BEN cannot afford to delay. Rate limiting the transfer is another option, trading a longer download for a smaller share of the link.

3.3 Storage growth

Storing 50,000 STIX objects per day at about 2 KB each is roughly 100 MB per day, around 36 GB per year before indexes. Indexes and enrichment can triple that. Retention policies are therefore engineering inputs.

Kofi turns these figures into a retention question for the CTI lead: how long must expired indicators stay searchable? Keeping two years of raw objects plus indexes could exceed two hundred gigabytes, while summarising expired items after ninety days keeps the store far smaller. The answer depends on whether investigations need old indicators, and that is a requirement to agree with analysts rather than a choice for the storage team.

3.4 Clocks

Server clocks drift. If Lantern's collector and BEN's firewall disagree by two minutes, time-to-block measurements are wrong by two minutes. Network time synchronisation and recorded clock sources matter for evidence.

Kofi checks that every Lantern server and the firewall take time from the same synchronised source, and that each log records which source it used. When the firewall's clock was found running fast during a test, he corrected past measurements by the known offset and noted the correction beside the results. A metric built on unsynchronised clocks can show negative times to block, which is the quickest sign that something is wrong.

3.5 Power and heat

An on-premises Lantern cluster draws power and needs cooling. In an energy company that sounds trivial, but SOC rooms are not data centres; capacity planning includes the room.

Kofi estimated the draw of three servers and found it close to what the room's cooling could remove on a hot afternoon. Adding a fourth server would have needed new cooling, a cost the original plan had missed. Placing the cluster in BEN's data centre instead removed the problem, at the price of a longer network path to the SOC.

Practice note — Latency budgets

End-to-end latency is a sum: network round trips, queue waits, parsing, enrichment and the firewall push. Kofi writes a budget table with a target for each term so that a 30-minute service level can be checked component by component. When one term grows, the table shows which stage stole the time.

Worked example

Kofi estimates nightly transfer time for a 2 GB partner archive: 2 GB × 8 = 16 Gbit, / 0.1 Gbit/s = 160 s. With 30% protocol overhead he plans about 210 s and schedules it at 02:00, away from substation telemetry peaks.

Synthetic case. Feed sizes and link speeds are invented.

Errors and limits

Back-of-envelope figures guide design; measure before committing hardware. Bits and bytes are a frequent factor-of-eight error.

Exercises

Synthesis

Physics sets floors on latency, budgets for bandwidth and storage, and the accuracy of every timestamp an analyst trusts.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →