Chapter 10 — Security architecture and engineering: quality and troubleshooting
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Quality review"]
N2["10.2 A disruptive control"]
N3["10.3 Improving safely"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Quality review"]
N2["10.2 A disruptive control"]
N3["10.3 Improving safely"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Quality review]
|
v
[10.2 A disruptive control]
|
v
[10.3 Improving safely]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) review the quality of security work; (2) troubleshoot a control that disrupts operations; (3) improve without losing protection.
10.1 Quality review
Ines asks Owen to review his own earlier work as if he were an auditor. He checks whether each finding has evidence, each requirement has a test, each decision has an owner and each document has a date and version. He finds two decisions with no recorded owner and one requirement tested only once before a vendor update. He fixes the records and schedules a retest. Regular self-review catches quality gaps before others do and builds habits that make later audits straightforward.
10.2 A disruptive control
After the refund hold goes live, the call centre reports angry tenants whose genuine refunds are delayed seven days after updating bank details, including elderly tenants who changed banks after a branch closed. Owen investigates. The hold is working as designed, but the design did not consider legitimate urgent cases. He meets finance and the call centre to understand the volume: about twelve genuine cases a month. The control is right in principle but too rigid in practice. He records the complaints and volumes as evidence.
10.3 Improving safely
Owen proposes an exception path: if the tenant confirms the change through a call back to their registered phone number made by a different team, the hold can be shortened to one day. The exception requires two people, preserving separation of privilege, and is logged. Finance accepts. Complaints fall, and no fraud occurs through the exception in the first three months. Ines notes that good practitioners adjust controls in response to real effects rather than defending the original design or removing protection under pressure.
Worked example
Owen self-reviews his work, investigates complaints about the refund hold and adds a two-person exception path that keeps protection.
Synthetic case. Volumes and outcomes are synthetic.
Errors and limits
Exceptions can be abused if checks weaken. Three months is a short observation period.
Exercises
- EX046 — Self-review gaps. What did Owen's self-review find? Rubric: 3 = two decisions without owners and one requirement tested once before an update;; 2 = gaps;; 1 = vague;; 0 = none.
- EX047 — Genuine cases. How many genuine urgent cases occur per month? Rubric: 3 = about twelve;; 2 = twelve;; 1 = vague;; 0 = none.
- EX048 — Exception path. How can the hold be shortened? Rubric: 3 = call back to the registered number by a different team, then one day;; 2 = call back;; 1 = removed;; 0 = none.
- EX049 — Principle kept. Which principle does the exception preserve? Rubric: 3 = separation of privilege, by requiring two people;; 2 = two people;; 1 = vague;; 0 = none.
- EX050 — Early results. What happened in the first three months of the exception? Rubric: 3 = complaints fell and no fraud used the exception;; 2 = both;; 1 = vague;; 0 = none.
Synthesis
Quality review and responsive troubleshooting improve controls without abandoning their protective purpose.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →