◇ OpenCyber Academy
Technologist · Chapter 8 · English

Chapter 8 — Security architecture basics

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 8 — Security architecture basics

Lesson map

Lesson 08 published. Map, example, EX022.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Layers"]
  N2["8.2 Matching indicators to layers"]
  N3["8.3 Segmentation"]
  N4["8.4 Collateral damage"]
  N5["8.5 Payment card systems"]
  N6["8.6 Recording blocks"]
  N7["Backups and recovery"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX022"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Layers"]
  N2["8.2 Matching indicators to layers"]
  N3["8.3 Segmentation"]
  N4["8.4 Collateral damage"]
  N5["8.5 Payment card systems"]
  N6["8.6 Recording blocks"]
  N7["Backups and recovery"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX022"]

[Learning outcomes]
    |
    v
[8.1 Layers]
    |
    v
[8.2 Matching indicators to layers]
    |
    v
[8.3 Segmentation]
    |
    v
[8.4 Collateral damage]
    |
    v
[8.5 Payment card systems]
    |
    v
[8.6 Recording blocks]
    |
    v
[Backups and recovery]
    |
    v
[Worked example] --> [Exercise EX022]

Learning outcomes

You will (1) describe layered defences in a municipal network; (2) choose the right layer for each indicator type; (3) explain segmentation of public-access networks; (4) recognise collateral damage from blocking.

8.1 Layers

Email gateway, DNS filter, web proxy, endpoint protection, identity provider, network segmentation and backups. Each layer can use some intelligence; none uses all of it.

Lena keeps a short note of what each layer can accept: domains for DNS, addresses for the firewall, hashes for endpoint protection, sender details for the email gateway. That note answers the first question for every new indicator, which is where it can actually be used, before anyone discusses whether it should be. The backup layer cannot take indicators at all, so ransomware intelligence reaches it only as advice about design.

8.2 Matching indicators to layers

Sender domains go to the email gateway; malicious domains to DNS and proxy; file hashes to endpoint protection; addresses used in password attacks to identity-provider conditional access; ransomware technique intelligence to backup design.

The ransomware item in that list is different from the rest: it does not produce a block, but supports a design decision such as keeping an offline backup. Lena routes each type to the owner of the matching layer, so a hash does not end up in a firewall request where it could never match anything.

8.3 Segmentation

Library public computers, staff desktops, servers and payment systems sit in separate zones. Intelligence about attackers moving between systems via remote services (T1021) supports keeping those zones strictly separated.

If library public computers could reach staff servers, an infection brought in on a resident's USB stick would have a path to council data. Keeping the zones separate means an attacker who gains one zone must still cross a boundary, where the network team can watch and block. Intelligence about lateral movement reminds owners why that boundary must stay strict.

8.4 Collateral damage

Blocking a shared hosting address can cut off a legitimate supplier. Blocking a popular file-sharing domain stops staff from receiving planning documents. Before blocking, Lena checks whether the indicator is shared or popular and asks the owner.

The cost of a wrong block falls on residents and staff, not on the attacker, who usually moves to a new address. Lena checks how many sites share an address and whether a domain is widely used before recommending a block. The worked example shows that the narrower choice, a domain rather than an address, often achieves the same protection.

8.5 Payment card systems

The payments portal falls under card-industry rules. Changes there go through its own approval process; intelligence is passed to its owner, not applied directly.

The card rules require changes to the payments portal to be approved and recorded, so a block or configuration change applied directly by the security team could break compliance as well as the service. Lena therefore sends intelligence about payment fraud or portal software to the payments owner, who decides whether and how to act. Lena still records each item she sends there, so the payments owner's decision appears in her monthly table.

8.6 Recording blocks

Every block is recorded with its source, reason, date and review date. When a resident complains that a site is unreachable, the service desk can check the record and lift a mistaken block quickly.

The review date makes each block temporary unless renewed, which matters because addresses and domains change hands. A domain used for fraud today may be cleaned up or sold within months. Recording the source also lets Lena remove every block based on a feed that later proves unreliable, without hunting through firewall rules one by one.

Backups and recovery

Ransomware intelligence often reports attackers deleting backups before encrypting. CMS keeps an offline copy and tests restores every quarter, so a council service can be rebuilt even if online copies are destroyed.

Worked example

MCX lists an address hosting a fraud page. Lena checks it: a large cloud provider address used by thousands of sites. She recommends blocking the specific domain at DNS instead of the address at the firewall, and reporting the page to the provider's abuse team through the supervisor.

Synthetic case. The address and page are invented.

Errors and limits

Layer choices depend on what each tool supports; check product capabilities.

Exercises

Synthesis

Send each indicator to the layer that can use it, segment zones, avoid collateral damage and record every block.

Continue studying — chapter 08 of 30

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →