Chapter 5 — Security architecture and engineering: design alternatives | Postgraduate Security architecture and engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security architecture and engineering: design alternatives

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Generating alternatives"]
  N2["5.2 Attributes as criteria"]
  N3["Lab — Attribute scores and a sensitivity sweep"]
  N4["5.3 Trade-offs made explicit"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Generating alternatives"]
  N2["5.2 Attributes as criteria"]
  N3["Lab — Attribute scores and a sensitivity sweep"]
  N4["5.3 Trade-offs made explicit"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Generating alternatives]
    |
    v
[5.2 Attributes as criteria]
    |
    v
[Lab — Attribute scores and a sensitivity sweep]
    |
    v
[5.3 Trade-offs made explicit]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) generate genuinely different design alternatives; (2) compare them on business attributes; (3) choose with explicit trade-offs.

5.1 Generating alternatives

For the clinic access decision, Priya insists on at least three real alternatives rather than one favoured design and two straw men. Option one keeps local firewalls and VPNs but automates certificate renewal. Option two moves all clinics to a cloud access broker with identity-aware policies. Option three is hybrid: a cloud broker for staff applications with local segmentation and a local fallback path for clinical systems. She asks a colleague who favours option one to write its case, so each option is argued by someone who believes in it.

5.2 Attributes as criteria

Priya uses business attributes in the style of SABSA (Sherwood, Clark and Lynas, 2005) as criteria: available, protected, auditable, operable by a small team and affordable. Clinical leaders weight availability highest because clinics cannot stop seeing patients. The lab below scores the three options and checks whether the ranking holds when the availability weight changes. The hybrid option ranks first in the base case and when availability matters more; the cloud option wins only if the availability weight falls to 0.20 or lower, which no clinical leader supports.

Lab — Attribute scores and a sensitivity sweep

# Score three access designs on weighted attributes and sweep the availability weight (synthetic).
attrs = ["available", "protected", "auditable", "operable", "affordable"]
score = {"local": [3, 2, 2, 3, 4], "cloud": [3, 5, 5, 4, 3], "hybrid": [5, 4, 4, 3, 3]}
def rank(wa):
    rest = (1 - wa) / 4; w = [wa] + [rest] * 4
    return {o: sum(a * b for a, b in zip(w, s)) for o, s in score.items()}
for wa in (0.40, 0.60, 0.20, 0.05):
    r = rank(wa); best = max(r, key=r.get)
    print(f"availability weight {wa:.2f}: " + ", ".join(f"{o} {v:.2f}" for o, v in r.items()) + f" -> {best}")

Run with python3 lab_options.py. Verified output:

availability weight 0.40: local 2.85, cloud 3.75, hybrid 4.10 -> hybrid
availability weight 0.60: local 2.90, cloud 3.50, hybrid 4.40 -> hybrid
availability weight 0.20: local 2.80, cloud 4.00, hybrid 3.80 -> cloud
availability weight 0.05: local 2.76, cloud 4.19, hybrid 3.57 -> cloud

5.3 Trade-offs made explicit

The hybrid option is not free. It keeps two access paths, which doubles some operational work and creates a risk that the fallback path is neglected until it is needed. Priya writes these costs into the decision record, along with a mitigation: quarterly tests of the local fallback in two clinics. She notes that the hybrid choice reflects the board's value judgement about availability, and that a different board could reasonably choose otherwise. Making that dependence explicit keeps the recommendation honest about where judgement enters.

Worked example

Priya develops three real alternatives with advocates, scores them on five attributes with a sensitivity sweep and records the hybrid option's costs and mitigations.

Synthetic case. Options, scores and weights are synthetic; SABSA is real.

Errors and limits

Attribute scores are judgements. Two access paths add operational load.

Exercises

EX021 — Straw men. Why insist on three real alternatives? Rubric: 3 = to avoid one favoured design with straw men;; 2 = fair comparison;; 1 = speed;; 0 = none.
EX022 — Highest weight. Which attribute did clinical leaders weight highest and why? Rubric: 3 = availability, because clinics cannot stop seeing patients;; 2 = availability;; 1 = cost;; 0 = none.
EX023 — Base ranking. Which option ranked first in the base case in the lab? Rubric: 3 = hybrid, 4.10;; 2 = hybrid;; 1 = cloud;; 0 = none.
EX024 — Cloud wins when. When does the cloud option win in the sweep? Rubric: 3 = at an availability weight of 0.20 or lower;; 2 = low weight;; 1 = always;; 0 = none.
EX025 — Hybrid cost. What hidden cost does the hybrid option carry? Rubric: 3 = two access paths, with a risk the fallback is neglected;; 2 = fallback;; 1 = vague;; 0 = none.

Synthesis

Honest alternatives, attribute criteria and sensitivity checks make trade-offs explicit rather than hidden.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →