Chapter 10 — Security architecture and engineering: control configuration
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Writing rules"]
N2["Lab — Testing flows against the rule list"]
N3["10.2 Documenting purpose"]
N4["10.3 Reviewing rules"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Writing rules"]
N2["Lab — Testing flows against the rule list"]
N3["10.2 Documenting purpose"]
N4["10.3 Reviewing rules"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 Writing rules]
|
v
[Lab — Testing flows against the rule list]
|
v
[10.2 Documenting purpose]
|
v
[10.3 Reviewing rules]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) configure segment firewall rules; (2) document each rule's purpose; (3) review rules for errors.
10.1 Writing rules
Nadia turns the segmented design from chapter 6 into firewall rules for Elmfield's router. Each rule names a source segment, a destination, a port and an action. Surgery PCs may reach the imaging server on its viewer port. The imaging server may reach head office backups through the VPN. Card terminals may reach only the payment provider's addresses. Guests may reach only the internet. A final rule denies everything else between segments. Ordering matters: routers apply the first matching rule, so specific allows come before the general deny.
Lab — Testing flows against the rule list
# Test expected and forbidden flows against an ordered rule list (synthetic).
def allowed(rules, src, dst, port):
for s, d, p, act in rules:
if s in (src, "*") and d in (dst, "*") and p in (port, "*"): return act == "allow"
return False
tests = [("surgery", "imaging", 8443, True), ("imaging", "backup", 445, True), ("payment", "provider", 443, True),
("guest", "internet", 443, True), ("reception", "imaging", 8443, False), ("guest", "imaging", 8443, False),
("reception", "payment", 443, False)]
v1 = [("staff", "imaging", 8443, "allow"), ("imaging", "backup", 445, "allow"), ("payment", "provider", 443, "allow"),
("guest", "internet", "*", "allow"), ("*", "*", "*", "deny")]
seg = {"surgery": "staff", "reception": "staff"}
v2 = [("surgery", "imaging", 8443, "allow")] + v1[1:]
for name, rules, mapping in (("first draft", v1, seg), ("split segments", v2, {})):
fails = [t for t in tests if allowed(rules, mapping.get(t[0], t[0]), t[1], t[2]) != t[3]]
print(f"{name}: {len(tests) - len(fails)}/{len(tests)} pass; failures {[(f[0], f[1], f[2]) for f in fails]}")
Run with python3 lab_fw.py. Verified output:
first draft: 6/7 pass; failures [('reception', 'imaging', 8443)]
split segments: 7/7 pass; failures []
10.2 Documenting purpose
Next to every rule Nadia writes its purpose and owner, such as "surgery viewing of X-rays, owner Grace". Rules without a documented purpose are the ones that accumulate and are never removed, because nobody dares delete them. She stores the rule list with the network diagram. When a vendor later asks for a new rule, Grace can check whether it fits the design and record why it was added, keeping the rule set understandable for years. The rule list is reviewed once a year with the network diagram.
10.3 Reviewing rules
Before applying the rules, Nadia tests them with a small script that checks a list of expected and forbidden flows. The lab shows that all expected flows are allowed, but one forbidden flow, reception PCs to the imaging server, is also allowed because she wrote the surgery rule for the whole staff segment. She splits staff into reception and surgery segments and reruns the test, which then passes. Testing rules before applying them prevents both outages and gaps. She keeps the test list for reuse after deployment.
Worked example
Nadia writes ordered segment rules with purposes and owners, tests expected and forbidden flows and fixes a rule that was too broad.
Synthetic case. Rules and segments are synthetic.
Errors and limits
Tests cover only listed flows. Router syntax differs from the test model.
Exercises
- EX037 — Rule order. Why must specific allows come before the general deny? Rubric: 3 = routers apply the first matching rule;; 2 = first match;; 1 = vague;; 0 = none.
- EX038 — Undocumented rules. Why do undocumented rules accumulate? Rubric: 3 = nobody dares delete them;; 2 = fear;; 1 = vague;; 0 = none.
- EX039 — Lab failure. Which forbidden flow did the first test allow? Rubric: 3 = reception to imaging on port 8443;; 2 = reception;; 1 = vague;; 0 = none.
- EX040 — Fix. How did Nadia fix the broad rule? Rubric: 3 = split staff into reception and surgery segments;; 2 = split;; 1 = vague;; 0 = none.
Synthesis
Ordered, documented and tested rules turn a segmentation design into a working configuration.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →