Chapter 8 — Security architecture basics | Technologist Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Security architecture basics

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Zones for a school"]
  N2["8.2 Default deny between zones"]
  N3["8.3 Protecting management"]
  N4["8.4 Keeping the design simple"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Zones for a school"]
  N2["8.2 Default deny between zones"]
  N3["8.3 Protecting management"]
  N4["8.4 Keeping the design simple"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Zones for a school]
    |
    v
[8.2 Default deny between zones]
    |
    v
[8.3 Protecting management]
    |
    v
[8.4 Keeping the design simple]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) design zones for the school; (2) apply default deny between zones; (3) protect management.

8.1 Zones for a school

A zone groups devices with similar trust and needs. Tomás proposes six zones: staff, students, administration (finance and records), guest, shared devices (printers and projectors) and management (switches, access points and virtualisation hosts). Each zone gets its own subnet. Students should reach the internet and the learning platform, staff should additionally reach teaching files and shared devices, and administration should be reachable only by office staff. The proposal is based on the risk ranking from chapter 5. Gareth reviews the list and confirms each group.

8.2 Default deny between zones

Traffic between zones passes through the firewall, which allows only listed flows and denies everything else. This approach, recommended in NIST SP 800-41r1, means that forgotten or new flows are blocked until someone decides to allow them. Tomás lists the needed flows for each zone pair. Students to administration has no entries at all. Students to shared devices has one entry, printing to student printers only. Writing the list forces explicit decisions instead of leaving access to chance. Each entry names its owner and reason.

8.3 Protecting management

Network devices and virtualisation hosts are managed through web pages or command-line sessions. If students can reach those interfaces, they could try to change the network. Tomás places all management interfaces in the management zone, reachable only from Gareth's administrator workstation, and recommends using SSH and HTTPS rather than older unencrypted protocols such as Telnet. During his review, he finds two switches with Telnet still enabled, which sends passwords in clear text across the network. Both are scheduled for SSH-only access.

8.4 Keeping the design simple

A school has one technician, so the design must be simple to run. Tomás resists adding more zones or complex rules. He uses consistent names, a small set of rules and a one-page diagram. He documents the reason for each zone and flow, so that Gareth or a successor can understand the design quickly. Saltzer and Schroeder's principle of economy of mechanism supports this choice: simpler designs are easier to check and less likely to hide mistakes. Gareth confirms he can explain every rule.

Worked example

The design has six zones, fourteen needed flows and a default deny rule; two switches are flagged for disabling Telnet.

Synthetic case. The design is synthetic.

Errors and limits

Designs too complex for the available staff are quietly simplified in unsafe ways later.

Exercises

EX022 — Student to admin flows. How many flows are allowed from students to administration? Rubric: 3 = none; that zone pair has no allowed flows;; 2 = none, without the zone-pair reason;; 1 = some;; 0 = no answer.
EX023 — Telnet risk. Why replace Telnet on switches? Rubric: 3 = sends passwords in clear text;; 2 = unencrypted;; 1 = old;; 0 = none.
EX024 — Simplicity reason. Which design principle supports keeping the school design simple? Rubric: 3 = economy of mechanism (Saltzer and Schroeder);; 2 = simplicity;; 1 = vague;; 0 = none.

Synthesis

Purposeful zones, default deny and protected management form a simple, effective school architecture.

Continue studying — chapter 08 of 30

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →