Chapter 9 — Security architecture and engineering: tools and methods | Technical Security architecture and engineering

Lesson map

Lesson 09 published. Map, example, EX033.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Checklist reviews"]
  N2["9.2 A simple threat model"]
  N3["9.3 Choosing methods"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX033"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Checklist reviews"]
  N2["9.2 A simple threat model"]
  N3["9.3 Choosing methods"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX033"]

[Learning outcomes]
    |
    v
[9.1 Checklist reviews]
    |
    v
[9.2 A simple threat model]
    |
    v
[9.3 Choosing methods]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX033]

Learning outcomes

You will (1) use a checklist method for configuration reviews; (2) use a simple threat model; (3) choose the right method for the task.

9.1 Checklist reviews

For routine work, Nadia uses checklists. She builds one for practice PCs based on the operating system vendor's security baseline: updates current, disk encryption on, firewall on, no local administrator for daily use, screen lock set and antivirus active. Checklists are quick and consistent, and they suit repeated tasks across five practices. Daniel warns that checklists only find what they list, so they suit known settings, not new designs, where a threat-modelling method is needed to discover what to check.

9.2 A simple threat model

When Linden plans online booking for patients, Nadia uses STRIDE from Shostack (2014) on the design. She asks for each part: can someone pretend to be a patient, change a booking, deny making one, see other patients' bookings, flood the system or gain staff rights? The method finds that the draft design shows other patients' names on the booking calendar. The vendor changes the calendar to show only free slots. A structured method found a problem that a checklist would not have covered.

9.3 Choosing methods

Nadia writes a guide for Grace: use checklists for routine settings on known devices; use STRIDE for new systems and changes to data flows; use the failure mode list for resilience planning; and use reviews of logs for checking what actually happened. Each method has a cost in time. Using the right one avoids wasting effort, such as threat modelling a printer replacement or using a checklist for a new online service. The guide is one page long and sits in the IT folder. Grace adds a column for the typical time each method takes, so she can plan the week realistically.

Worked example

Nadia builds a PC checklist, uses STRIDE to catch patient names on a booking calendar and writes a guide on choosing methods.

Synthetic case. The booking design is synthetic; Shostack (2014) is real.

Errors and limits

Checklists go stale. Threat models depend on accurate designs.

Exercises

EX033 — Checklist limit. What is the limit of a checklist?
Show marking criteria
Rubric: 3 = it only finds what it lists;; 2 = coverage;; 1 = vague;; 0 = none.
EX034 — STRIDE finding. What did STRIDE find in the booking design?
Show marking criteria
Rubric: 3 = other patients' names shown on the calendar;; 2 = names;; 1 = vague;; 0 = none.
EX035 — Vendor fix. How did the vendor fix the calendar?
Show marking criteria
Rubric: 3 = show only free slots;; 2 = slots;; 1 = vague;; 0 = none.
EX036 — Method for new systems. Which method suits new systems?
Show marking criteria
Rubric: 3 = STRIDE threat modelling;; 2 = STRIDE;; 1 = checklist;; 0 = none.

Synthesis

Checklists suit routine settings, while threat models suit new designs; choosing well saves time and finds real problems.

Continue studying — chapter 09 of 18

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →