Chapter 2 — Security architecture and engineering: current practice

Learning outcomes

You will (1) survey current architecture practice in health care; (2) compare it with published guidance; (3) identify gaps in Corvane's practice.

2.1 What practitioners do

Priya interviews architects at three peer health organisations, all anonymised for the course. They share patterns: identity-centred access for staff, network segmentation separating clinical devices, vendor remote access through brokered sessions, and architecture review boards for new systems. None uses formal methods such as SABSA in full; all borrow parts, such as business attribute profiles. She notes that practice is shaped by small teams, legacy medical devices that cannot be patched and regulators who expect documented risk decisions rather than particular designs.

2.2 Comparing with guidance

Priya maps the observed practice against NIST SP 800-160 Vol. 1 Rev. 1, which describes systems security engineering across the life cycle, and ISO/IEC 27001:2022, which requires an information security management system. Practice aligns well on access control and supplier management but is weak on verification: most organisations review designs before build but rarely test whether delivered systems match those designs. Guidance expects verification as a life-cycle activity. The gap matters because undetected drift between design and reality is where many incidents begin.

2.3 Corvane's gaps

Applying the comparison to Corvane, Priya finds the same verification weakness and two more. Clinical devices share a network with administrative laptops in nine clinics, and architecture reviews have no record of which risks were accepted. She ranks these by consequence: device segmentation first, because a laptop infection could reach infusion pump management stations; then verification; then accepted-risk records. She presents the ranking with sources so that the chief information officer can see the gaps are measured against recognised guidance rather than her opinion alone.

Worked example

Priya compares anonymised peer practice with SP 800-160v1r1 and ISO/IEC 27001, finds a common verification gap and ranks three gaps at Corvane.

Synthetic case. Interviews and Corvane details are synthetic; SP 800-160 Vol. 1 Rev. 1 and ISO/IEC 27001:2022 are real.

Errors and limits

Three interviews do not represent a sector. Guidance alignment is not proof of security.

Exercises

• EX006 — Common pattern. Name two patterns the three peer organisations share.
  Show marking criteria

  Rubric: 3 = identity-centred access, device segmentation, brokered vendor access, review boards;; 2 = one;; 1 = vague;; 0 = none.
• EX007 — SABSA use. How do peers use SABSA?
  Show marking criteria

  Rubric: 3 = they borrow parts such as attribute profiles, not the full method;; 2 = parts;; 1 = full method;; 0 = none.
• EX008 — Verification gap. What verification gap did Priya find in practice?
  Show marking criteria

  Rubric: 3 = delivered systems are rarely tested against their designs;; 2 = testing;; 1 = design reviews;; 0 = none.
• EX009 — First priority. Why rank device segmentation first at Corvane?
  Show marking criteria

  Rubric: 3 = a laptop infection could reach infusion pump management stations;; 2 = patient safety;; 1 = cost;; 0 = none.
• EX010 — Why cite sources. Why did Priya present gaps with sources?
  Show marking criteria

  Rubric: 3 = so they are seen as measured against guidance, not opinion;; 2 = credibility;; 1 = vague;; 0 = none.

Synthesis

Comparing real practice with guidance reveals specific, rankable gaps, especially in verification.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →