Chapter 13 — Security architecture and engineering: troubleshooting

Lesson map

Lesson 13 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["13.1 The problem"]
  N2["13.2 Using logs"]
  N3["13.3 Fixing properly"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["13.1 The problem"]
  N2["13.2 Using logs"]
  N3["13.3 Fixing properly"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]

[Learning outcomes]
    |
    v
[13.1 The problem]
    |
    v
[13.2 Using logs]
    |
    v
[13.3 Fixing properly]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) diagnose a problem caused by a security change; (2) use logs to find the cause; (3) fix it while keeping the control.

13.1 The problem

Two weeks after segmentation, the Norbury practice reports that X-ray images take minutes to appear in surgery. Staff suspect the new firewall. Nadia starts by describing the symptom exactly: images load, but slowly, only in two of four surgeries, and only since Tuesday. She asks what changed on Tuesday and learns that a new X-ray sensor was installed in surgery three. Precise symptoms narrow the search far faster than general complaints that the network is slow. She writes these details in the ticket before investigating further.

13.2 Using logs

Nadia checks the router's firewall logs, which show repeated denied connections from surgery PCs to the imaging server on a second port. The new sensor's software uses an extra port for image previews, which the rules do not allow. The viewer retries before falling back to the slower method, causing delays. The cause is a legitimate new flow, not a fault in the design. Logs turned a vague complaint into a specific missing rule within twenty minutes. She saves the relevant log lines as evidence in the ticket.

13.3 Fixing properly

Nadia confirms the port with the sensor vendor's documentation, then adds a rule allowing surgery PCs to reach the imaging server on that port only, with the purpose and owner recorded. She reruns the verification tests from chapter 11 and adds the new port to the expected flow list. Images load normally again. She also adds a step to the change procedure: new clinical devices must have their network needs documented before installation, so the next device does not cause the same delay.

Worked example

Nadia narrows a slow imaging complaint, finds denied connections in logs, adds one documented rule and updates the change procedure.

Synthetic case. The devices and ports are synthetic.

Errors and limits

Vendor documentation can be incomplete. Retry behaviour hides denials from users.

Exercises

• EX049 — Precise symptom. What precise symptom did Nadia record?
  Show marking criteria

  Rubric: 3 = slow image loading in two of four surgeries since Tuesday;; 2 = precise;; 1 = vague;; 0 = none.
• EX050 — Log evidence. What did the firewall logs show?
  Show marking criteria

  Rubric: 3 = denied connections from surgery PCs to the imaging server on a second port;; 2 = denials;; 1 = vague;; 0 = none.
• EX051 — Proper fix. How was it fixed?
  Show marking criteria

  Rubric: 3 = one documented rule for that port only, then retesting;; 2 = narrow rule;; 1 = allow all;; 0 = none.
• EX052 — Prevention. What prevents a repeat?
  Show marking criteria

  Rubric: 3 = documenting new device network needs before installation;; 2 = change procedure;; 1 = vague;; 0 = none.

Synthesis

Precise symptoms and logs find the real cause, and narrow fixes keep controls intact.

Continue studying — chapter 13 of 18

← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →