Chapter 11 — Security architecture and engineering: assets and context
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Ranking assets"]
N2["11.2 Business context"]
N3["11.3 Assets and attributes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Ranking assets"]
N2["11.2 Business context"]
N3["11.3 Assets and attributes"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Ranking assets]
|
v
[11.2 Business context]
|
v
[11.3 Assets and attributes]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) rank assets by business importance; (2) describe the business context and constraints; (3) link assets to security attributes.
11.1 Ranking assets
Using the inventory from chapter 1, Tomás asks operations managers which systems matter most. The tracking service ranks first, because without it parcels cannot be routed or tracked. The conveyor controller ranks second, because manual sorting cuts depot throughput by two thirds. Handhelds rank third. Office PCs matter less except for the finance office. Ranking by business consequence, rather than by technical complexity, tells Tomás where protection and recovery effort should go first when time is limited. He records the ranking with the date and the names of the managers consulted, so it can be revisited before each peak season.
11.2 Business context
Tomás records the constraints that shape design. Depots run from four in the morning to ten at night, leaving short maintenance windows. Peak season in winter triples volume. The conveyor vendor requires remote access for support. Staff turnover among sorters is high, and many are agency workers. Margins are thin, so expensive tools are hard to justify. Every security recommendation must fit these constraints, and writing them down early stops Tomás proposing designs that would never be accepted. He shares the list with Ruth so she can judge his later proposals against it.
11.3 Assets and attributes
For each top asset, Tomás notes which security attribute matters most. The tracking service needs availability and integrity, since wrong routing causes missed deliveries. Customer data needs confidentiality. The conveyor needs availability and safety, since faulty commands could injure staff. Finance needs integrity of payments. Linking assets to attributes in the style of SABSA's business attributes (Sherwood, Clark and Lynas, 2005) helps him choose controls: backups and redundancy for availability, access control and encryption for confidentiality. He keeps the attribute list beside the asset ranking so both are reviewed together each year.
Worked example
Tomás ranks assets by business consequence, records operational constraints and links each top asset to its most important security attribute.
Synthetic case. Rankings and constraints are synthetic; SABSA is real.
Errors and limits
Managers may overrate their own systems. Attributes change with seasons and contracts.
Exercises
- EX031 — Top asset. Which asset ranked first and why? Rubric: 3 = the tracking service; parcels cannot be routed without it;; 2 = tracking;; 1 = conveyor;; 0 = none.
- EX032 — Constraint example. Name two constraints Tomás recorded. Rubric: 3 = long operating hours, peak season, vendor remote access, staff turnover, thin margins;; 2 = one;; 1 = vague;; 0 = none.
- EX033 — Conveyor attributes. Which attributes matter most for the conveyor? Rubric: 3 = availability and safety;; 2 = availability;; 1 = confidentiality;; 0 = none.
Synthesis
Ranking assets by business consequence within real constraints shows where to focus protection.
Continue studying — chapter 11 of 30
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →