Chapter 17 — Security architecture and engineering: tooling

Chapter 17 — Security architecture and engineering: tooling

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Needs before tools"]
  N2["17.2 A trial"]
  N3["17.3 Avoiding sprawl"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Needs before tools"]
  N2["17.2 A trial"]
  N3["17.3 Avoiding sprawl"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Needs before tools]
    |
    v
[17.2 A trial]
    |
    v
[17.3 Avoiding sprawl]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) choose tools for a small security team; (2) evaluate a tool on a trial; (3) avoid tool sprawl.

17.1 Needs before tools

Vendors approach Brightwater with security products. Tomás lists needs first: device inventory, update reporting, central logs, vulnerability scanning of internet-facing services and backup monitoring. He checks what existing systems already do: the device management service covers inventory and updates, and the cloud provider offers basic logging. Only vulnerability scanning and log alerting are true gaps. Starting from needs rather than products prevents buying overlapping tools that nobody has time to run. He writes the needs list on one page and asks Sam to rank them, so that any later purchase can be traced back to a specific, agreed gap.

17.2 A trial

Tomás runs a two-week trial of an external vulnerability scanner against Brightwater's public addresses, with written permission from Sam and the hosting provider. He defines trial criteria: findings accuracy, false alarms, effort to run and cost. The scanner finds an outdated web server banner on the old customer portal and a certificate due to expire. It also reports two false alarms about services that are not running. He records the time spent each week, because a tool that takes hours of triage may not suit a team of two.

17.3 Avoiding sprawl

Tomás recommends one scanner and using existing cloud logging with three alert rules rather than buying a full monitoring platform. He writes down who runs each tool, how often and where results go. Each tool must have an owner and a purpose linked to a risk scenario from chapter 13. Tools without owners become shelfware that gives false comfort. Sam approves the plan, noting that the total cost is lower than one vendor's opening quote for an all-in-one platform. The tool list is reviewed each year with the risk scenarios.

Worked example

Tomás lists needs before products, trials a scanner with written permission against set criteria and recommends a minimal owned toolset.

Synthetic case. Tools and findings are synthetic.

Errors and limits

Trials are short and may miss issues. Free tiers can change.

Exercises

• EX049 — True gaps. Which needs were true gaps? Rubric: 3 = vulnerability scanning and log alerting;; 2 = one;; 1 = inventory;; 0 = none.
• EX050 — Trial permission. What did Tomás obtain before scanning? Rubric: 3 = written permission from Sam and the hosting provider;; 2 = permission;; 1 = vague;; 0 = none.
• EX051 — Shelfware. What happens to tools without owners? Rubric: 3 = they become shelfware giving false comfort;; 2 = shelfware;; 1 = vague;; 0 = none.

Synthesis

Choose tools from needs, trial them against criteria and give each one an owner and a purpose.

Continue studying — chapter 17 of 30

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →