Chapter 12 — Cryptography and trust services: data flows
Lesson map
Lesson 12 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Tracing flows"]
N2["12.2 Finding gaps"]
N3["12.3 Prioritising fixes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Tracing flows"]
N2["12.2 Finding gaps"]
N3["12.3 Prioritising fixes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX034"]
[Learning outcomes]
|
v
[12.1 Tracing flows]
|
v
[12.2 Finding gaps]
|
v
[12.3 Prioritising fixes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes
You will (1) trace data flows between council services and partners; (2) identify protection gaps in each flow; (3) prioritise fixes by sensitivity and exposure.
12.1 Tracing flows
Rosa traces data flows for the permit and document services: citizen to gateway, gateway to application, application to database, application to payment provider, provider back to application by webhook, application to document-signing service, signed documents to the archive and backups to off-site storage. For each flow she records data type, protocol, protection and who controls the keys. She uses a simple table rather than an elaborate diagram, because the table can be sorted and filtered when planning fixes. She also records the frequency of each flow, since a nightly batch and a constant stream call for different monitoring.
12.2 Finding gaps
The table shows gaps: plain HTTP between gateway and applications, noted earlier; backups encrypted with a key stored on the backup server itself, so anyone stealing the server gets both; and signed documents archived without the timestamp and certificate status data needed for long-term validation. One flow, the export of permit data to a parking-enforcement contractor, travels as an emailed spreadsheet. Rosa flags it as the most exposed because it leaves the council's control entirely and has no encryption. She also notices that nobody could say who owned the export, which explains why it was never reviewed.
12.3 Prioritising fixes
Rosa ranks fixes by sensitivity of the data and exposure of the flow. The emailed export ranks first: personal data leaves the council unprotected. Next comes the backup key stored with backups, then the internal HTTP hop, then archive validation data. For the export she proposes a secure file transfer with TLS and per-file encryption to the contractor's public key, using a vetted tool. Owen approves the ranking and asks her to write the change requests, which she does with rollback plans.
Worked example
Rosa's flow table finds four gaps and ranks an emailed permit export first, proposing secure transfer with encryption to the contractor's key.
Synthetic case. Flows and contractor are invented.
Errors and limits
Flow tables omit undocumented "shadow" flows; ask owners. Encrypting backups with a key stored beside them gives little protection.
Exercises
- EX034 — Table choice. Why does Rosa use a table for flows? Rubric: 3 = it can be sorted and filtered when planning fixes;; 2 = sortable;; 1 = prettier;; 0 = none.
- EX035 — Backup gap. What was wrong with backup encryption? Rubric: 3 = key stored on the backup server itself;; 2 = key beside data;; 1 = vague;; 0 = none.
- EX036 — Top fix. Which flow ranked first and what fix was proposed? Rubric: 3 = emailed permit export; secure transfer with TLS and per-file encryption to contractor's key;; 2 = flow;; 1 = fix;; 0 = none.
Synthesis
Tracing data flows with key ownership exposes gaps that diagrams miss, and ranking by sensitivity and exposure focuses effort.
Continue studying — chapter 12 of 30
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →