◇ OpenCyber Academy
Master's · Chapter 4 · English

Chapter 4 — Security architecture and engineering: competing explanations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Security architecture and engineering: competing explanations

Lesson map

Lesson 04 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Rivals to the main hypothesis"]
  N2["4.2 Checks that separate rivals"]
  N3["4.3 Modelling artefacts"]
  N4["4.4 What would change the conclusion"]
  N5["4.5 Discussing rivals with practitioners"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Rivals to the main hypothesis"]
  N2["4.2 Checks that separate rivals"]
  N3["4.3 Modelling artefacts"]
  N4["4.4 What would change the conclusion"]
  N5["4.5 Discussing rivals with practitioners"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX021"]

[Learning outcomes]
    |
    v
[4.1 Rivals to the main hypothesis]
    |
    v
[4.2 Checks that separate rivals]
    |
    v
[4.3 Modelling artefacts]
    |
    v
[4.4 What would change the conclusion]
    |
    v
[4.5 Discussing rivals with practitioners]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) list rival explanations for an expected result; (2) design checks that distinguish them; (3) recognise artefacts of modelling choices; (4) decide in advance what would change your conclusion.

4.1 Rivals to the main hypothesis

Kenji expects identity-based micro-segmentation to reduce reach. Before testing, he lists rivals that could produce the same pattern. First, the difference might come from the number of allowed edges alone, not from identity: any policy with fewer edges would look better. Second, it might depend on network size, appearing only in small networks. Third, it might be an artefact of how he generated identity rules, giving each workstation exactly one server. Fourth, results could hinge on jump hosts, which the lab in chapter 3 showed can erase the benefit. Each rival predicts something different that he can check.

4.2 Checks that separate rivals

For the edge-count rival, Kenji adds a control policy: random edges removed from the flat network until it has the same number of edges as the identity policy. If identity still beats this random control, structure matters, not just edge count. For the size rival, he generates networks at three sizes. For the generation artefact, he varies how many servers each identity may reach, from one to four. For jump hosts, he varies their rule breadth. Each check is a small experiment written into the plan before the main runs, so the dissertation can report which rivals survived.

4.3 Modelling artefacts

Simulation results can reflect modelling choices rather than reality. Kenji's model treats every host as equally exploitable, ignores time and assumes policies are enforced perfectly. If real enforcement points are misconfigured a fraction of the time, identity policies with many fine rules may leak more than zone policies with few broad ones. He adds a misconfiguration parameter that randomly adds a small share of unintended edges. This connects back to the economy-of-mechanism concern from the seminar: complex rule sets offer more chances for error, and the model should be able to show that trade-off rather than assume it away.

4.4 What would change the conclusion

Kenji writes down, before seeing results, what would make him conclude that identity-based segmentation does not offer a meaningful advantage: if its mean reach is within one server of the random-edge control, or if a misconfiguration rate of two per cent erases most of the difference. Writing these thresholds in advance protects him from moving the goalposts after seeing the data. Dr Aydın notes that most master's dissertations never state such conditions, and that doing so is one of the clearest signs of research maturity an examiner can see.

4.5 Discussing rivals with practitioners

Kenji presents his rival list to two Vantor network engineers. They add a rival he had missed: in practice, identity-based rules are often written by copying templates, so many workstations end up with the same broad access, reducing the benefit. He adds a template parameter that makes a share of workstations inherit a broad rule set. Practitioners know failure modes that literature rarely records, and asking them early improves the model's realism. He acknowledges their contribution in the dissertation without naming them, as agreed.

Worked example

Kenji lists five rivals, adds a random-edge control, size and generation variations, a misconfiguration rate and a template-copy parameter, and writes thresholds that would overturn his expectation.

Synthetic case. Rivals, thresholds and engineer input are synthetic.

Errors and limits

No list of rivals is complete. Parameters added to model reality can multiply runs and tempt selective reporting.

Exercises

Synthesis

Listing rivals, testing each with a designed check and fixing overturn conditions in advance turns an expected result into a tested one.

Continue studying — chapter 04 of 08

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →