Chapter 15 — Security architecture and engineering: guided lab
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 The lab task"]
N2["Lab — Flagging suspicious redirects in a manifest"]
N3["15.2 Setting thresholds"]
N4["15.3 Explaining alerts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 The lab task"]
N2["Lab — Flagging suspicious redirects in a manifest"]
N3["15.2 Setting thresholds"]
N4["15.3 Explaining alerts"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 The lab task]
|
v
[Lab — Flagging suspicious redirects in a manifest]
|
v
[15.2 Setting thresholds]
|
v
[15.3 Explaining alerts]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) validate manifests for suspicious changes; (2) set thresholds from data; (3) explain alerts to operations staff.
15.1 The lab task
Ruth sets a guided lab: write a script that compares a new manifest with the previous one from the same retailer and flags suspicious changes, such as many parcels redirected to one new address. The script runs on synthetic manifests. Tomás starts by listing what normal looks like: retailers rarely change more than a few addresses between uploads, and almost never send many parcels to a single new address. Defining normal first keeps the rule tied to the business rather than to guesses about attackers.
Lab — Flagging suspicious redirects in a manifest
# Flag manifests sending more than three parcels to the same new address (synthetic).
known = {"12 Hill Rd", "4 Mill St", "7 Park Ave", "22 Dock St", "3 Elm Ct"}
manifests = {"R1": ["12 Hill Rd", "4 Mill St", "8 Oak Way", "7 Park Ave"],
"R2": ["9 Quay Lane"] * 5 + ["22 Dock St", "3 Elm Ct"],
"R3": ["5 Bay Rd", "5 Bay Rd", "6 Fern Cl", "12 Hill Rd"]}
for r, addrs in manifests.items():
new = {}
for a in addrs:
if a not in known: new[a] = new.get(a, 0) + 1
hits = {a: n for a, n in new.items() if n > 3}
print(f"{r}: {len(addrs)} parcels, new addresses {new} -> {'FLAG ' + str(hits) if hits else 'ok'}")
Run with python3 lab_manifest.py. Verified output:
R1: 4 parcels, new addresses {'8 Oak Way': 1} -> ok
R2: 7 parcels, new addresses {'9 Quay Lane': 5} -> FLAG {'9 Quay Lane': 5}
R3: 4 parcels, new addresses {'5 Bay Rd': 2, '6 Fern Cl': 1} -> ok
15.2 Setting thresholds
The script counts parcels whose address changed and parcels sent to an address that appears for the first time. Tomás sets a threshold: flag if more than three parcels move to the same new address. The lab finds one retailer's manifest with five parcels redirected to one new address, which he marks for a phone call to the retailer before dispatch. He checks the threshold against three months of synthetic history to make sure it would not have flagged normal manifests more than once a week.
15.3 Explaining alerts
Tomás writes a one-paragraph explanation for depot supervisors: what the alert means, why it matters and what to do, which is to hold the parcels and call the retailer on a known number, not one in the manifest. He adds an example from the lab. Supervisors ask how often alerts will appear; he answers with his historical estimate. Clear explanations matter because an alert nobody understands is ignored, and an alert that says what to do gets acted on. The explanation is printed and kept at each supervisor desk.
Worked example
Tomás builds a manifest comparison rule, sets a threshold checked against history and writes a clear supervisor instruction.
Synthetic case. Manifests and history are synthetic.
Errors and limits
Thresholds miss attacks below them. Calling retailers adds delay.
Exercises
- EX043 — Normal first. Why define normal before writing the rule? Rubric: 3 = to tie the rule to the business, not guesses;; 2 = business;; 1 = vague;; 0 = none.
- EX044 — Lab finding. What did the lab flag? Rubric: 3 = retailer R2: 5 parcels to new address 9 Quay Lane;; 2 = five;; 1 = vague;; 0 = none.
- EX045 — Known number. Why call the retailer on a known number? Rubric: 3 = the manifest's number may belong to the criminal;; 2 = fraud;; 1 = quicker;; 0 = none.
Synthesis
Simple rules built from normal behaviour, with clear instructions, catch fraud that technical controls miss.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →