Chapter 10 — Security architecture and engineering: orientation
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 The life cycle"]
N2["10.2 The technologist's role"]
N3["10.3 Planning the placement"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 The life cycle"]
N2["10.2 The technologist's role"]
N3["10.3 Planning the placement"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 The life cycle]
|
v
[10.2 The technologist's role]
|
v
[10.3 Planning the placement]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) describe the security architecture and engineering life cycle; (2) locate a technologist's role in it; (3) plan the rest of the placement.
10.1 The life cycle
Ruth outlines the life cycle described in NIST SP 800-160 Vol. 1 Rev. 1: understand needs and context, define requirements, design, build or acquire, verify, deploy, operate and retire. Security belongs in every stage, not only at the end. Tomás maps recent Brightwater changes onto the cycle. The new label printers were bought without any security requirement, so their default passwords were never changed. Had a requirement existed at the acquisition stage, the supplier would have delivered them configured correctly. He adds this example to his placement log as a lesson about acquisition.
10.2 The technologist's role
Technologists work mostly in build, verify, deploy and operate. Tomás's tasks will include configuring devices to the design, testing that controls work, documenting changes and spotting problems in operation that should change the design. Architects decide the overall shape; technologists make it real and report where reality differs from the drawing. Ruth stresses that this feedback loop is essential: designs that ignore operational experience become fiction, and technologists are the people best placed to notice. Sam agrees to hold a short monthly meeting where Tomás reports such differences.
10.3 Planning the placement
Tomás agrees a plan with Sam for the remaining weeks: map assets and data flows, write risk scenarios, apply two methods to a real change, run a guided lab, build automation, set up monitoring, troubleshoot and finally hand over a capstone. Each week has a deliverable reviewed by Sam. Writing the plan down helps both sides manage expectations and lets Ruth check that the placement covers the course outcomes. It also gives Tomás a record of what he achieved for future job applications.
Worked example
Tomás maps changes onto the life cycle, defines the technologist's role in it and agrees a weekly placement plan with deliverables.
Synthetic case. Plans and devices are synthetic; SP 800-160 Vol. 1 Rev. 1 is real.
Errors and limits
Life-cycle models look linear; real work loops back. Placement plans change with business needs.
Exercises
- EX028 — Printer lesson. What went wrong with the new label printers? Rubric: 3 = no security requirement at purchase, so default passwords stayed;; 2 = requirements;; 1 = vendor;; 0 = none.
- EX029 — Technologist stages. In which stages do technologists mostly work? Rubric: 3 = build, verify, deploy and operate;; 2 = three;; 1 = design only;; 0 = none.
- EX030 — Feedback loop. Why is the technologist's feedback essential? Rubric: 3 = designs that ignore operations become fiction;; 2 = reality;; 1 = vague;; 0 = none.
Synthesis
Technologists make architecture real across the life cycle and feed operational reality back into design.
Continue studying — chapter 10 of 30
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →