◇ OpenCyber Academy
Technologist · Chapter 9 · English

Chapter 9 — Security principles in practice

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Security principles in practice

Lesson map

Lesson 09 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Defence in depth"]
  N2["9.2 Secure defaults"]
  N3["9.3 Usability matters"]
  N4["9.4 Economy of mechanism"]
  N5["Fail-safe thinking"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Defence in depth"]
  N2["9.2 Secure defaults"]
  N3["9.3 Usability matters"]
  N4["9.4 Economy of mechanism"]
  N5["Fail-safe thinking"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX025"]

[Learning outcomes]
    |
    v
[9.1 Defence in depth]
    |
    v
[9.2 Secure defaults]
    |
    v
[9.3 Usability matters]
    |
    v
[9.4 Economy of mechanism]
    |
    v
[Fail-safe thinking]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) apply defence in depth; (2) use secure defaults; (3) balance usability.

9.1 Defence in depth

No single control is perfect, so several layers are combined. For a teacher's laptop: updates reduce flaws, standard accounts limit damage, the firewall limits exposure, encryption protects lost devices, and backups allow recovery. If one layer fails, others still help.

Each layer covers a different failure: an update missed for a week still leaves the teacher on a standard account, and a stolen laptop with an unpatched flaw is still encrypted. The layers only help if they are independent, which is why the shared local administrator password matters at the trust: one leak would defeat the same layer on every laptop at once.

9.2 Secure defaults

Systems should start safe and be loosened only when needed. A new laptop arrives from the build with all baseline settings; exceptions are requested and recorded. This is easier to maintain than starting open and hoping to remember to close things.

At the trust, the laptop image used to be built open and then tightened by hand, which is why the screen lock and the firewall's public profile differed between laptops. Building the image from the agreed baseline reverses that: every new laptop starts with fifteen settings applied, and the exceptions list shows exactly which laptops differ and why.

9.3 Usability matters

Controls that get in the way of teaching will be bypassed. A screen lock of one minute in a classroom where a teacher walks around while displaying slides will cause frustration. Tomás learns to discuss settings with staff and choose values that protect without blocking work.

Tomás asks three teachers how they use their laptops during lessons before suggesting any value, and they explain that they often leave slides on the projector for several minutes. A setting chosen without that conversation would either be ignored or lead to complaints that end with the whole baseline being relaxed.

9.4 Economy of mechanism

Simple designs are easier to check. Saltzer and Schroeder (1975) argued for keeping security mechanisms as small and simple as possible. For the trust, this means fewer tools, each well understood, rather than many overlapping products.

For Dev, every extra tool is another console to check weekly, another agent to update and another place where a setting can drift. Tomás's scripts follow the same idea: each one reads one export, checks one thing and prints one summary line, so Dev can understand any of them in a few minutes and fix it if an export format changes.

Fail-safe thinking

When something goes wrong, the safer outcome should follow by default. Saltzer and Schroeder called this fail-safe defaults: base access decisions on permission rather than exclusion. At the trust it shows up in small choices. If the management agent cannot reach its server, the laptop keeps its last policy rather than dropping to an open state. If a backup check script finds no data to read, it reports a failure rather than printing nothing, so a missing report is never mistaken for success. And if a new staff account is created without a role, it gets no access until one is assigned, rather than inheriting a broad default group.

Worked example

For the screen lock, staff and Dev agree on ten minutes with a keyboard shortcut to lock immediately, recorded as a deviation from the fifteen-minute CIS suggestion only in that it is stricter.

Synthetic case. Discussion is synthetic.

Errors and limits

Layers that all depend on one thing, such as the same admin password, are not independent.

Exercises

Synthesis

Good security combines layers, starts from safe defaults and respects how people work.

Continue studying — chapter 09 of 30

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →