◇ OpenCyber Academy
Technologist · Chapter 8 · English

Chapter 8 — Security architecture basics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Security architecture basics

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Segmentation"]
  N2["8.2 Central logging"]
  N3["8.3 Time synchronisation"]
  N4["8.4 Forensic readiness"]
  N5["8.5 Low-cost improvements"]
  N6["8.6 Documentation"]
  N7["8.7 Prioritising"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Segmentation"]
  N2["8.2 Central logging"]
  N3["8.3 Time synchronisation"]
  N4["8.4 Forensic readiness"]
  N5["8.5 Low-cost improvements"]
  N6["8.6 Documentation"]
  N7["8.7 Prioritising"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Segmentation]
    |
    v
[8.2 Central logging]
    |
    v
[8.3 Time synchronisation]
    |
    v
[8.4 Forensic readiness]
    |
    v
[8.5 Low-cost improvements]
    |
    v
[8.6 Documentation]
    |
    v
[8.7 Prioritising]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) describe segmentation, central logging and time sync; (2) identify architecture choices that help or hinder investigations; (3) propose low-cost improvements; (4) relate architecture to readiness.

8.1 Segmentation

Separating networks limits spread. At Alder Falls all office desktops share one VLAN, so a compromised desktop can reach every other desktop's remote-desktop port.

The finding on CLERK-03 shows the effect: remote desktop from another office PC was possible because nothing separated desktops from each other. Segmentation need not mean new hardware; host firewall rules that allow remote desktop only from IT management machines achieve much of the benefit. They also make unusual traffic easier to see, because legitimate paths become few and known.

8.2 Central logging

Sending logs to a central collector protects them from deletion on compromised hosts and keeps them beyond local rotation. Alder Falls forwards server logs but not desktop logs.

Because desktop logs stay on the desktops, the CLERK-03 logons were visible only after examining the PC, and an intruder with admin rights could have cleared them. A central collector receiving desktop security events would have kept an independent copy and let Renata search across many machines at once instead of visiting each one.

8.3 Time synchronisation

All devices should sync to the same time source. Correlating CLERK-03's events with firewall logs depended on it.

When clocks drift, the order of events across sources becomes uncertain. A firewall record at 08:01 and a logon at 08:02:40 on CLERK-03 can be compared only if both clocks agree. Renata confirms that every device syncs to the same internal time server and that the server itself follows a trusted external source, and records the check in the case notes. A drift of even a minute can reverse the apparent order of a logon and the action it enabled.

8.4 Forensic readiness

ISO/IEC 27043 includes readiness: preparing logging, retention, tools and procedures before incidents. For a city, readiness reduces investigation time and cost.

For Alder Falls this means deciding in advance which logs are kept and for how long, which tools are approved, who may collect evidence and where it is stored. Without that preparation, Renata's team spent hours finding logs and permissions during the CLERK-03 case. Each readiness item should be traceable to a question an investigation will need answered. Readiness also includes practice: a short drill each year shows whether the plan works.

8.5 Low-cost improvements

Block desktop-to-desktop remote desktop with host firewall rules; forward desktop security logs; set unique local admin passwords; keep weekly baselines.

Each of these uses tools the city already has. Host firewall rules and local password management are features of the operating system; log forwarding needs collector space; weekly baselines need a scheduled script. Jonah's estimate for each lists effort, cost and which incident question it would have answered faster in the CLERK-03 case. None requires a new product, and each can be reversed if it causes problems.

8.6 Documentation

Network diagrams and log source lists are kept current; out-of-date diagrams mislead investigators.

At Alder Falls, the network diagram still showed a separate VLAN for the permits office that had been merged two years earlier. Jonah corrects it and adds a date and owner to the diagram and to the list of log sources. An investigator who trusts an old diagram may conclude that traffic was impossible when it was actually allowed. Diagrams should be reviewed whenever a network change is approved, not only once a year.

8.7 Prioritising

Changes that both prevent attacks and preserve evidence come first.

Blocking desktop-to-desktop remote desktop does both: it would have prevented the CLERK-03 logon from another desktop and, by reducing legitimate traffic, made any attempt stand out. Forwarding desktop logs mainly helps investigation; unique local admin passwords mainly prevent spread. Jonah ranks them in that order in his note, giving each a short reason Renata can defend to managers. Changes that only add cost without improving prevention or evidence wait until the others are done. Jonah also marks which items need an outage, because those must be scheduled with service owners rather than applied at once.

Remote access

The VPN lets staff work from home. Architecture choices — requiring multi-factor authentication, restricting which internal systems VPN users can reach, and logging every session — reduce risk and give investigators clear records of remote activity. Jonah confirms VPN logs reach the central collector and are kept for twelve months, longer than the desktop logs.

Cost of readiness

Forwarding desktop logs needs collector storage; Jonah estimates the volume from a week of samples and presents the cost beside the investigation hours lost in this incident.

Worked example

Jonah drafts a one-page architecture note: "Observed: desktop-to-desktop RDP allowed; desktop logs not forwarded; identical local admin passwords. Effect in this incident: lateral movement from 10.20.4.12 to CLERK-03 possible and only visible on CLERK-03. Recommendation: block desktop RDP, forward desktop logs, rotate local admin passwords."

Synthetic case. The note is invented.

Errors and limits

Architecture changes take time and money; prioritise and phase them, measuring effect.

Exercises

Synthesis

Simple architecture choices decide how far attacks spread and how much evidence survives.

Continue studying — chapter 08 of 30

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →