Chapter 6 — Security architecture and engineering: system model
Lesson map
Lesson 06 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Zones and flows"]
N2["6.2 Trust boundaries"]
N3["6.3 A segmented design"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Zones and flows"]
N2["6.2 Trust boundaries"]
N3["6.3 A segmented design"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX021"]
[Learning outcomes]
|
v
[6.1 Zones and flows]
|
v
[6.2 Trust boundaries]
|
v
[6.3 A segmented design]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) model the Elmfield practice as zones and flows; (2) mark trust boundaries; (3) propose a segmented design.
6.1 Zones and flows
Nadia models Elmfield as components and flows: reception PCs to the cloud practice system, surgery PCs to the cloud and the imaging server, X-ray sensors to the imaging server, the imaging server to head office backups, card terminals to the payment provider and guests to the internet. She draws each flow as an arrow labelled with its protocol. The model shows that card terminals and X-ray sensors never need to talk to reception PCs, yet the flat network allows it.
6.2 Trust boundaries
Nadia marks boundaries: between the practice and the internet, between practice and head office, between patients' guest network and staff networks, and around the payment terminals, which the payment provider requires to be isolated. She also marks a boundary around clinical imaging, because image integrity affects diagnosis. Each boundary needs a control that allows only the listed flows. Marking boundaries turns a vague sense that the network is too open into specific places where filtering belongs. She numbers each boundary on the diagram so that later chapters and rule lists can refer to them precisely.
6.3 A segmented design
Nadia proposes four segments: staff PCs, clinical imaging, payment terminals and guest. The router's firewall allows only the modelled flows between them. Surgery PCs may reach the imaging server on its viewer port; nothing else may. Card terminals reach only the payment provider. Grace reviews the design and asks whether the router supports separate networks; it does, using virtual LANs. Nadia's design follows the idea of limiting implicit trust based on network location described in NIST SP 800-207, scaled to a small site.
Worked example
Nadia models Elmfield's flows, marks five trust boundaries and proposes four segments with explicit allowed flows.
Synthetic case. The model is synthetic; SP 800-207 is real.
Errors and limits
Models miss undocumented flows. Router features vary by model.
Exercises
- EX021 — Unneeded paths. Which devices never need to talk to reception PCs? Rubric: 3 = card terminals and X-ray sensors;; 2 = both;; 1 = vague;; 0 = none.
- EX022 — Imaging boundary. Why place a boundary around clinical imaging? Rubric: 3 = image integrity affects diagnosis;; 2 = integrity;; 1 = vague;; 0 = none.
- EX023 — Four segments. What four segments did Nadia propose? Rubric: 3 = staff PCs, clinical imaging, payment terminals and guest;; 2 = three;; 1 = vague;; 0 = none.
- EX024 — Router support. How does the router support segments? Rubric: 3 = virtual LANs;; 2 = VLANs;; 1 = vague;; 0 = none.
Synthesis
A model with marked boundaries leads directly to a segmented design with explicit allowed flows.
Continue studying — chapter 06 of 18
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →