Chapter 8 — Security architecture basics | Technologist Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Zones"]
  N2["8.2 Boundaries"]
  N3["8.3 Remote access"]
  N4["8.4 Sensors"]
  N5["8.5 Backups"]
  N6["8.6 Defence in depth"]
  N7["8.7 Reviewing against attacks"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Zones"]
  N2["8.2 Boundaries"]
  N3["8.3 Remote access"]
  N4["8.4 Sensors"]
  N5["8.5 Backups"]
  N6["8.6 Defence in depth"]
  N7["8.7 Reviewing against attacks"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Zones]
    |
    v
[8.2 Boundaries]
    |
    v
[8.3 Remote access]
    |
    v
[8.4 Sensors]
    |
    v
[8.5 Backups]
    |
    v
[8.6 Defence in depth]
    |
    v
[8.7 Reviewing against attacks]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) describe zones and boundaries in a small business network; (2) place controls and sensors appropriately; (3) plan secure remote access; (4) evaluate an architecture against likely attacks.

8.1 Zones

Even a clinic has zones: reception PCs, the server, the X-ray workstation, guest Wi-Fi and the internet. Guest Wi-Fi should never reach the server.

Each zone has its own trust level: reception PCs handle bookings and records, the server stores them, the X-ray workstation runs vendor software, and guest Wi-Fi carries patients' phones. Placing patients' devices on the same network as the server would let any infected phone reach the file share. The X-ray workstation also deserves its own zone, because it cannot run an agent and its traffic should therefore be as predictable as possible.

8.2 Boundaries

The firewall separates zones and the internet. Rules should allow only needed traffic: reception PCs to the server's database and file ports, nothing from the internet inward except through the VPN.

Writing rules this way means anything not listed is refused by default. If a reception PC later tries to reach the server on an unexpected port, the firewall denies and logs it, and that denied line becomes evidence Copperleaf can see rather than a connection that silently succeeds. The rule list is short at a clinic, so Mei can read every entry during a review and check that each one has a named reason to exist.

8.3 Remote access

A VPN with MFA lets the IT contractor and managers connect securely. Remote desktop is then allowed only from VPN addresses.

The contractor's support sessions continue as before, but each starts with a VPN logon and a second factor. On the firewall, the rule for 3389 now names the VPN address range as its only permitted source, so the internet scanners that produced 41,000 attempts in a week see nothing to try. Any remote desktop connection that does not come from the VPN range is now refused at the firewall and logged as denied, which is easy to alert on.

8.4 Sensors

Endpoint agents on server and PCs, firewall logs and the cloud email audit log give Copperleaf visibility. The X-ray workstation runs vendor software that forbids agents, so firewall logs are its only monitoring.

The X-ray gap is a deliberate trade-off rather than an oversight, because installing an agent would breach the vendor's support terms. Mei records it so that analysts know any investigation of that workstation must rely on connection records alone, which show where it talked to but not what ran on it.

8.5 Backups

Backups must sit outside the zone an attacker could control, or be immutable.

BrightSmile's nightly backups sit on a network device in the server room, inside the same zone as the server. Raj's recommendation of an offline or immutable copy follows from this rule: a backup an administrator can delete is not safe from an attacker who has become administrator. An offline copy is disconnected after each backup run, while an immutable copy cannot be altered or deleted until its retention period ends, even by an administrator. Either choice means the most recent good copy survives an attacker who controls the clinic network.

8.6 Defence in depth

No single control stops everything: VPN, MFA, least privilege, monitoring and backups together make a successful attack much harder.

The May incident shows how the layers would have worked together. Without exposure the guessing would not have started; with MFA it would not have succeeded; with least privilege support2 could not have been created; and with offline backups even a successful encryption would not have been final. Copperleaf presents the layers to BrightSmile as a short list, so the office manager can see which ones are already in place and which remain open.

8.7 Reviewing against attacks

Mei walks the ransomware steps from chapter 5 through the new architecture: access now needs VPN plus MFA; privilege is limited; monitoring alerts on account changes and file spikes; backups are offline.

At each step Mei asks what the attacker would now need and what Copperleaf would see. Guessing the reception password is no longer enough without the second factor, and a new administrator or a burst of file renames now raises an alert. If encryption still started despite all this, an offline copy would remain for recovery.

Documenting the architecture

Mei draws each client's network on one page: zones, firewall rules, sensors and backup location. When an alert arrives at night, the analyst can see at a glance what a host can reach and what monitoring covers it, without calling the client.

Worked example

The architecture review finds that guest Wi-Fi and reception PCs share one network at clinic 3. Mei recommends separating them with the firewall's guest network feature. The change takes thirty minutes and costs nothing.

Synthetic case. Networks and reviews are invented.

Errors and limits

Small clients may resist changes that inconvenience staff; explain the risk plainly.

Exercises

EX022 — Firewall rule set. What inbound traffic should the clinic firewall allow from the internet?
Show marking criteria
Rubric: 3 = only VPN; nothing else; 2 = partial; 1 = remote desktop; 0 = none.
EX023 — X-ray workstation. How is the X-ray workstation monitored, and why?
Show marking criteria
Rubric: 3 = firewall logs only; vendor forbids agents; 2 = partial; 1 = agent; 0 = none.
EX024 — Clinic 3 finding. What did the review find at clinic 3?
Show marking criteria
Rubric: 3 = guest Wi-Fi shared reception network; separated; 2 = partial; 1 = vague; 0 = none.

Synthesis

Simple zones, tight boundaries, secure remote access and layered controls give small businesses strong protection.

Continue studying — chapter 08 of 30

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →