Chapter 8 — Security architecture and engineering: failure modes
Lesson map
Lesson 08 published. Map, example, EX029.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Listing failures"]
N2["8.2 Accident or attack"]
N3["8.3 Responses"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX029"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Listing failures"]
N2["8.2 Accident or attack"]
N3["8.3 Responses"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX029"]
[Learning outcomes]
|
v
[8.1 Listing failures]
|
v
[8.2 Accident or attack]
|
v
[8.3 Responses]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX029]
Learning outcomes
You will (1) list ways practice systems can fail; (2) separate accidental and deliberate failures; (3) plan responses for the most damaging ones.
8.1 Listing failures
Nadia works with Grace to list failure modes for critical services. The internet link could fail, cutting access to the cloud practice system. The imaging server's disk could fill or fail. Ransomware could encrypt the imaging server. A staff member could delete images by mistake. The cloud vendor could have an outage. A power cut could stop everything. For each, she notes how they would notice and how long the practice could cope. Listing failures before they happen lets the team prepare calmly instead of improvising.
8.2 Accident or attack
Many failures look the same whether accidental or deliberate. Missing images might be a mistaken deletion or ransomware. Nadia notes signs that distinguish them: ransomware usually changes many files quickly and leaves ransom notes, while accidental deletion affects a few files. She adds both to the response plan, since the first steps differ: for ransomware, disconnect the server from the network; for deletion, restore from backup. Recognising the difference early prevents an accident being treated as a crisis or an attack being treated as routine.
8.3 Responses
For the most damaging failures Nadia writes short response cards. Internet down: switch to a mobile data backup router kept in reception, and use printed day lists. Imaging server lost: restore from the head office backup to a spare server, which she estimates takes four hours. Ransomware: isolate, call Grace, do not pay, restore from backup after the cause is understood. Each card fits on one page and names who acts. The cards are tested in a short tabletop exercise with the practice manager.
Worked example
Nadia lists six failure modes, distinguishes ransomware from deletion and writes one-page response cards tested in a tabletop.
Synthetic case. Failures and timings are synthetic.
Errors and limits
Response cards age as systems change. Restore times are estimates until tested.
Exercises
- EX029 — Ransomware signs. How does ransomware usually differ from accidental deletion? Rubric: 3 = many files change quickly and ransom notes appear;; 2 = volume;; 1 = vague;; 0 = none.
- EX030 — First ransomware step. What is the first step for ransomware? Rubric: 3 = disconnect the server from the network;; 2 = isolate;; 1 = restore;; 0 = none.
- EX031 — Internet fallback. What is the fallback when the internet fails? Rubric: 3 = a mobile data backup router and printed day lists;; 2 = backup router;; 1 = vague;; 0 = none.
- EX032 — Restore estimate. How long is the imaging restore estimated to take? Rubric: 3 = four hours;; 2 = four;; 1 = vague;; 0 = none.
Synthesis
Listing failure modes and writing tested one-page responses prepares a practice for both accidents and attacks.
Continue studying — chapter 08 of 18
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →