Chapter 17 — Network and communications security: tooling
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Choosing tools"]
N2["17.2 Authorised use"]
N3["17.3 Log collection"]
N4["17.4 Maintaining tools"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Choosing tools"]
N2["17.2 Authorised use"]
N3["17.3 Log collection"]
N4["17.4 Maintaining tools"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 Choosing tools]
|
v
[17.2 Authorised use]
|
v
[17.3 Log collection]
|
v
[17.4 Maintaining tools]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) choose suitable tools; (2) use them safely and with authorisation; (3) maintain tooling.
17.1 Choosing tools
Technologists use many tools: configuration managers, log collectors, monitoring dashboards and small scripts. Tomás chooses tools for the school by asking what problem each solves, whether Gareth can run it alone, what it costs and how it is supported. He prefers built-in features of existing equipment, such as the firewall's logging and the switches' configuration export, before adding new products. Every new tool adds something to maintain, update and secure, so tools must earn their place. Tomás writes a short note for each choice.
17.2 Authorised use
Some network tools can disrupt systems or reveal sensitive information if misused. Tomás uses tools only within the agreed scope and with Gareth's approval for each activity. He does not run discovery or testing tools against the school network; instead, he works with data exported by the systems themselves, as in the guided lab. The placement agreement makes this explicit. Authorised, careful use protects the school and Tomás and is expected of every professional in the field. Each approval is noted with its date.
17.3 Log collection
Tomás helps Gareth set up a central log collector on a small virtual machine in the management zone. Firewalls, switches and the wireless controller send logs to it using syslog, whose format is defined in RFC 5424. Logs are kept for ninety days, meeting requirement R6. The collector itself is protected: only Gareth can log in, and logs cannot be deleted from the devices that send them. A central store makes it possible to search across devices when investigating a problem.
17.4 Maintaining tools
Tools need care. The log collector needs disk space monitoring, updates and a check that every device is still sending logs. Scripts need tests and documentation. Tomás writes a short maintenance checklist covering each tool: what to check, how often and what to do if something is wrong. He also records which tools depend on which accounts and certificates. Unmaintained tools fail quietly, and a silent log collector is worse than none because people believe they have evidence they do not.
Worked example
The school adopts one new tool, a log collector, and documents maintenance for it and four scripts.
Synthetic case. Tooling is synthetic.
Errors and limits
Adding tools without maintenance plans creates new weaknesses and silent failures.
Exercises
- EX049 — Tool selection questions. List three questions for choosing a tool. Rubric: 3 = problem solved, can technician run it, cost or support;; 2 = two;; 1 = one;; 0 = none.
- EX050 — No scanning. How does Tomás obtain service data without scanning? Rubric: 3 = exports from systems with authorisation;; 2 = exports;; 1 = scans;; 0 = none.
- EX051 — Silent collector risk. Why is a silent log collector dangerous? Rubric: 3 = people believe they have evidence they lack;; 2 = false confidence;; 1 = vague;; 0 = none.
Synthesis
Fewer, well-chosen, authorised and maintained tools serve a small team best.
Continue studying — chapter 17 of 30
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →