OpenCyber AcademyLearning outcomes
You will (1) describe the parts of a computing system and how they interact; (2) inventory a depot's systems; (3) relate system parts to security exposure.
1.1 Parts of a system
Tomás Ferreira is a technologist student at the fictional Kestrel Polytechnic, placed with the fictional Brightwater Logistics, which runs four parcel depots. His instructor, Ruth Adeyemi, starts with the basics: a computing system combines hardware, firmware, an operating system, applications, data and the people who use it. Each layer depends on the one below. A depot's handheld scanner, for example, has a processor, firmware from the manufacturer, a mobile operating system, a scanning app and the parcel data it sends to the central tracking service.
1.2 Inventorying the depot
Tomás walks the main depot with Sam Okafor, Brightwater's infrastructure lead, and records every system: forty handheld scanners, twelve label printers, six office PCs, a sorting conveyor controller, two network switches, a wireless controller and a cloud tracking service. For each he notes the owner, the operating system, who maintains it and whether it holds parcel or customer data. He finds three label printers that nobody claims to own, which means nobody updates them. An inventory is the first security control because unknown systems cannot be protected.
1.3 Parts and exposure
Each layer brings its own exposure. Hardware can be stolen, firmware may carry flaws that are rarely patched, operating systems need updates, applications may have weak settings and data may leak. Tomás marks which layers Brightwater can change and which only the vendor can. The scanners' firmware, for example, can only be updated through the vendor's tool. Anderson (2020) stresses that security depends on the whole system, including the people and the maintenance arrangements, not only on its most visible software layer.
Worked example
Tomás describes system layers using a scanner, inventories a depot's systems and maps which layers Brightwater and vendors control.
Synthetic case. Brightwater, Kestrel and all people are synthetic; Anderson (2020) is real.
Errors and limits
Walk-through inventories miss systems in cupboards and vehicles. Ownership may be disputed.
Exercises
- EX001 — Scanner layers. Name the layers in a depot handheld scanner.
Show marking criteria
Rubric: 3 = processor, firmware, mobile OS, scanning app, parcel data;; 2 = three;; 1 = vague;; 0 = none. - EX002 — Unowned printers. Why are the three unowned label printers a problem?
Show marking criteria
Rubric: 3 = nobody updates them;; 2 = no updates;; 1 = vague;; 0 = none. - EX003 — Vendor-only layer. Which scanner layer can only the vendor update?
Show marking criteria
Rubric: 3 = the firmware, through the vendor's tool;; 2 = firmware;; 1 = app;; 0 = none.
Synthesis
Knowing every layer of every system, and who can change it, is where security begins.