Chapter 1 — Advanced security decision-making

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 The decision at Corvane"]
  N2["1.2 Facts, assumptions and values"]
  N3["1.3 Recording the decision"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 The decision at Corvane"]
  N2["1.2 Facts, assumptions and values"]
  N3["1.3 Recording the decision"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 The decision at Corvane]
    |
    v
[1.2 Facts, assumptions and values]
    |
    v
[1.3 Recording the decision]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) frame an organisation-scale architecture decision; (2) separate facts, assumptions and values; (3) record a decision so others can challenge it.

1.1 The decision at Corvane

Priya Ramanathan is a postgraduate student and the lead security architect at Corvane Health Network, a fictional group of twenty-two community clinics. Her supervisor, Dr Elena Voss at the fictional Brookmere University, asks her to bring a live decision to the course. Corvane must decide whether to consolidate its clinic networks behind one cloud-based access service or keep each clinic's local firewall and VPN. The choice affects patient data, clinic uptime, staff workflow and budget for five years, so it is an organisation-scale decision rather than a project detail.

1.2 Facts, assumptions and values

Priya splits her briefing into three columns. Facts are things she can check: twenty-two clinics, four firewall models, two outages last year caused by expired VPN certificates. Assumptions are beliefs she cannot yet verify, such as the cloud service meeting availability targets in rural areas with poor connectivity. Values are priorities the board must set, such as how much clinic downtime is acceptable to save money. Mixing these three is the most common cause of circular arguments in architecture meetings, because people argue about values while appearing to argue about facts.

1.3 Recording the decision

Priya writes an architecture decision record: context, options considered, criteria, the decision, consequences and the conditions that would cause the decision to be revisited. She cites the zero trust principles in NIST SP 800-207 as the design direction but notes they do not dictate any product. The record is short, dated and signed by the chief information officer. Two years later, a new architect can read why the choice was made and judge whether its conditions still hold, rather than guessing at the reasoning or repeating the whole debate.

Worked example

Priya frames the clinic network decision, sorts her briefing into facts, assumptions and values, and records it in a decision record with revisit conditions.

Synthetic case. Corvane, Brookmere and all people are synthetic; SP 800-207 is real.

Errors and limits

Decision records can become paperwork if no one reads them. Assumptions must be tested, not just listed.

Exercises

• EX001 — Organisation-scale test. Why is the clinic network choice an organisation-scale decision?
  Show marking criteria

  Rubric: 3 = it affects patient data, uptime, workflow and budget for five years across all clinics;; 2 = several effects;; 1 = it is technical;; 0 = none.
• EX002 — Assumption example. Give the assumption Priya could not yet verify.
  Show marking criteria

  Rubric: 3 = cloud service availability in rural clinics with poor connectivity;; 2 = availability;; 1 = certificate outages;; 0 = none.
• EX003 — Value for the board. Which value did Priya leave to the board?
  Show marking criteria

  Rubric: 3 = how much clinic downtime is acceptable to save money;; 2 = downtime;; 1 = firewall models;; 0 = none.
• EX004 — Circular arguments. What causes circular architecture arguments, according to the chapter?
  Show marking criteria

  Rubric: 3 = mixing facts, assumptions and values;; 2 = mixing;; 1 = budget;; 0 = none.
• EX005 — Revisit conditions. Why include revisit conditions in a decision record?
  Show marking criteria

  Rubric: 3 = so a later architect can judge whether the decision still holds;; 2 = future review;; 1 = vague;; 0 = none.

Synthesis

Advanced decisions improve when facts, assumptions and values are separated and the reasoning is recorded for later challenge.

Continue studying — chapter 01 of 12

← Course home · Course chapter index · Chapter 02 (draft) →