Chapter 8 — Security architecture and engineering: difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The unpatchable scanner"]
N2["8.2 A merger"]
N3["8.3 When no answer is clean"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The unpatchable scanner"]
N2["8.2 A merger"]
N3["8.3 When no answer is clean"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 The unpatchable scanner]
|
v
[8.2 A merger]
|
v
[8.3 When no answer is clean]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) handle a legacy device that cannot meet the architecture; (2) manage a merger of two networks; (3) reason through cases with no clean answer.
8.1 The unpatchable scanner
One clinic's imaging scanner runs an operating system that the manufacturer no longer supports, and replacing it would cost more than the clinic's annual equipment budget. It cannot join the identity-aware design. Priya treats it as a documented exception: isolate it on its own segment, allow only the imaging archive to talk to it, monitor that traffic and set a replacement date in the capital plan. The clinical governance committee accepts the residual risk in writing. Exceptions are managed risks, not hidden failures.
8.2 A merger
Corvane acquires a fictional private clinic group, Hollin Care, with a flat network and shared administrator accounts. Connecting the two networks quickly would import Hollin's weaknesses; keeping them apart blocks shared patient records. Priya proposes a staged integration: first, a brokered connection for specific applications only; second, Hollin staff move to Corvane identities; third, Hollin's network is rebuilt to Corvane's segmentation. Each stage has entry criteria. She uses Shostack's (2014) threat modelling to analyse the brokered connection before any traffic flows.
8.3 When no answer is clean
Both cases force trade-offs where every option leaves risk. Priya follows a pattern: state the options, the risk each leaves and who accepts it; choose the option that keeps the most important attribute, here availability of care; and set a date to revisit. She writes that the goal in difficult cases is not to remove risk but to make it visible, owned and temporary where possible. Dr Voss notes this is the core of senior architecture work, where textbook answers rarely fit.
Worked example
Priya isolates an unsupported scanner as a documented exception, plans a three-stage merger integration and applies a consistent pattern to cases with no clean answer.
Synthetic case. The scanner, Hollin Care and decisions are synthetic; Shostack (2014) is real.
Errors and limits
Exceptions tend to become permanent without dates. Staged mergers stall under business pressure.
Exercises
- EX036 — Scanner treatment. How was the unsupported scanner treated? Rubric: 3 = isolated, limited to the imaging archive, monitored, with a replacement date;; 2 = isolation;; 1 = replaced now;; 0 = none.
- EX037 — Exception owner. Who accepted the scanner's residual risk? Rubric: 3 = the clinical governance committee, in writing;; 2 = committee;; 1 = architect;; 0 = none.
- EX038 — Merger dilemma. Why was neither quick connection nor full separation acceptable? Rubric: 3 = quick imports weaknesses; separation blocks shared patient records;; 2 = both sides;; 1 = vague;; 0 = none.
- EX039 — First merger stage. What was the first merger stage? Rubric: 3 = a brokered connection for specific applications only;; 2 = brokered;; 1 = full join;; 0 = none.
- EX040 — Goal in hard cases. What is the goal in difficult cases? Rubric: 3 = make risk visible, owned and temporary where possible;; 2 = visible;; 1 = remove all risk;; 0 = none.
Synthesis
Difficult cases are handled by documented exceptions, staged plans and risk that is visible, owned and dated.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →