Chapter 3 — Security architecture and engineering: specialist evidence

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Specialist sources"]
  N2["3.2 Modelling reachability"]
  N3["Lab — Zone reachability before and after segmentatio"]
  N4["3.3 Proportionate evidence"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Specialist sources"]
  N2["3.2 Modelling reachability"]
  N3["Lab — Zone reachability before and after segmentatio"]
  N4["3.3 Proportionate evidence"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Specialist sources]
    |
    v
[3.2 Modelling reachability]
    |
    v
[Lab — Zone reachability before and after segmentatio]
    |
    v
[3.3 Proportionate evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) gather specialist evidence on clinical device risk; (2) model reachability between network zones; (3) present evidence proportionate to the decision.

3.1 Specialist sources

For the segmentation gap, Priya needs evidence beyond general guidance. She reads manufacturer security documentation for Corvane's infusion pump management stations, the clinical engineering team's inventory and the network team's firewall rules. Clinical engineers know which devices cannot be patched and which vendor connections they require. Their knowledge is specialist evidence that architects often lack. She records each source, its owner and its date, because device inventories in health care are notoriously incomplete and she must show how current her picture is.

3.2 Modelling reachability

Priya builds a small model of which zones can reach which others under the current rules, then repeats it under her proposed rules. The lab below computes reachability in both cases. Under current rules, the administrative laptop zone can reach the clinical device zone through a shared print server. Under the proposed rules, only the clinical engineering jump host can reach clinical devices. The model is simple, but it turns a long firewall export into a clear statement that a decision maker can follow and check.

Lab — Zone reachability before and after segmentation

# Zone reachability before and after segmentation (synthetic rules).
def reach(rules, start):
    seen, todo = {start}, [start]
    while todo:
        z = todo.pop()
        for a, b in rules:
            if a == z and b not in seen: seen.add(b); todo.append(b)
    return sorted(seen - {start})
current = [("admin", "print"), ("print", "clinical"), ("admin", "internet"), ("jump", "clinical"), ("clinical", "print")]
proposed = [("admin", "print"), ("admin", "internet"), ("jump", "clinical")]
for name, rules in [("current", current), ("proposed", proposed)]:
    print(f"{name}: admin reaches {reach(rules, 'admin')}; jump reaches {reach(rules, 'jump')}")

Run with python3 lab_reach.py. Verified output:

current: admin reaches ['clinical', 'internet', 'print']; jump reaches ['clinical', 'print']
proposed: admin reaches ['internet', 'print']; jump reaches ['clinical']

3.3 Proportionate evidence

Priya resists the urge to bring every detail to the board. She presents the reachability result, the count of affected clinics and the clinical engineers' view of operational impact. Detailed firewall rules go into an appendix for technical reviewers. The evidence is proportionate: enough to justify the decision and show its limits, not so much that the decision is lost. Dr Voss notes that proportion is a professional skill, because overwhelming decision makers with detail is a way of avoiding accountability for a clear recommendation.

Worked example

Priya gathers device and firewall evidence from specialists, models reachability before and after segmentation and presents a proportionate summary.

Synthetic case. Devices, zones and rules are synthetic.

Errors and limits

Inventories miss devices. Reachability models ignore application-layer paths not captured in rules.

Exercises

• EX011 — Specialist knowledge. What did clinical engineers know that architects often lack?
  Show marking criteria

  Rubric: 3 = which devices cannot be patched and which vendor connections they need;; 2 = devices;; 1 = vague;; 0 = none.
• EX012 — Current path. How could administrative laptops reach clinical devices under current rules?
  Show marking criteria

  Rubric: 3 = through the shared print server;; 2 = print server;; 1 = directly;; 0 = none.
• EX013 — Proposed path. What can reach clinical devices under the proposed rules?
  Show marking criteria

  Rubric: 3 = only the clinical engineering jump host;; 2 = jump host;; 1 = everything;; 0 = none.
• EX014 — Recording dates. Why record each source's date?
  Show marking criteria

  Rubric: 3 = inventories are often incomplete, so currency must be shown;; 2 = currency;; 1 = vague;; 0 = none.
• EX015 — Proportion. What does proportionate evidence mean here?
  Show marking criteria

  Rubric: 3 = enough to justify the decision and show limits, with detail in appendices;; 2 = enough;; 1 = everything;; 0 = none.

Synthesis

Specialist evidence and simple models turn complex configurations into proportionate decision evidence.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →