Chapter 14 — Security architecture and engineering: automation
Lesson map
Lesson 14 published. Map, example, EX053.
flowchart TD
N0["Learning outcomes"]
N1["14.1 Drift across sites"]
N2["Lab — Comparing practice settings with a baseline"]
N3["14.2 Reporting drift"]
N4["14.3 Safe automation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX053"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 Drift across sites"]
N2["Lab — Comparing practice settings with a baseline"]
N3["14.2 Reporting drift"]
N4["14.3 Safe automation"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX053"]
[Learning outcomes]
|
v
[14.1 Drift across sites]
|
v
[Lab — Comparing practice settings with a baseline]
|
v
[14.2 Reporting drift]
|
v
[14.3 Safe automation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX053]
Learning outcomes
You will (1) automate a configuration comparison across practices; (2) report drift; (3) keep automation safe.
14.1 Drift across sites
Five practices should share the same baseline, but settings drift as people make local changes. Nadia writes a script that compares each practice's exported router settings with a reference baseline and lists differences. Grace exports the settings monthly. Drift matters because a single forgotten change, such as a temporary rule left open, can undo the protection the design provides. Automation lets a small team check five sites consistently in minutes instead of reading long configuration files by eye. Grace agrees to run the comparison on the first Monday of each month.
Lab — Comparing practice settings with a baseline
# Compare practice router settings with a baseline (synthetic exports).
base = {"smb1": "off", "remote_admin_wan": "off", "guest_isolation": "on", "rule_preview_9443": "absent", "ntp": "on"}
sites = {"Elmfield": dict(base), "Ashby": dict(base), "Kingsley": dict(base),
"Norbury": dict(base, rule_preview_9443="present"), "Westcott": dict(base, remote_admin_wan="on")}
for s, cfg in sites.items():
diff = {k: (base[k], v) for k, v in cfg.items() if base[k] != v}
print(f"{s}: " + ("matches baseline" if not diff else f"differs {diff}"))
Run with python3 lab_drift.py. Verified output:
Elmfield: matches baseline
Ashby: matches baseline
Kingsley: matches baseline
Norbury: differs {'rule_preview_9443': ('absent', 'present')}
Westcott: differs {'remote_admin_wan': ('off', 'on')}
14.2 Reporting drift
The lab compares five practices. Three match the baseline. Norbury has the documented preview-port rule from chapter 13, which Nadia adds to the baseline because all practices will soon have the new sensors. Westcott has remote administration enabled from the internet, which nobody can explain. Grace disables it and changes the router password in case it had been used. The report lists each difference with a recommended action, separating approved changes from unexplained ones. Both findings and actions are logged so the next monthly report can confirm they stayed fixed.
14.3 Safe automation
The script reads exports and reports; it never changes router settings. Changes remain a human decision after review. Nadia stores the script and the baseline in Linden's repository with a change history, so updates to the baseline are visible. She adds a test that fails if an export is empty, which could otherwise look like perfect compliance. Daniel notes that read-only automation is the right first step for small teams, since it adds visibility without adding the risk of automated mistakes.
Worked example
Nadia compares five practices' router settings with a baseline, updates the baseline for an approved change and finds unexplained remote administration.
Synthetic case. Settings and practices are synthetic.
Errors and limits
Exports may omit some settings. Baselines need owners to stay current.
Exercises
- EX053 — Why drift matters. Why does drift matter? Rubric: 3 = one forgotten change can undo the design's protection;; 2 = undo;; 1 = vague;; 0 = none.
- EX054 — Westcott finding. What did the lab find at Westcott? Rubric: 3 = remote administration enabled from the internet;; 2 = remote admin;; 1 = vague;; 0 = none.
- EX055 — Baseline update. Why was Norbury's difference added to the baseline? Rubric: 3 = all practices will soon have the new sensors;; 2 = approved;; 1 = ignored;; 0 = none.
- EX056 — Empty export. Why test for empty exports? Rubric: 3 = an empty export could look like perfect compliance;; 2 = false pass;; 1 = vague;; 0 = none.
Synthesis
Read-only drift reports give small teams consistent visibility across sites while keeping changes under human control.
Continue studying — chapter 14 of 18
← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →