Characteristics of Security Architecture

Characteristics of Security Architecture

• Importance of Architecture:

  • Forms the foundation of good security.

  • How security is constructed is as important as the controls used.

• Analogy:

  • Winchester Mystery House: A poorly constructed house without blueprints or systematic design.

  • Lesson: Without a clear architecture, complex systems can become disorganized and ineffective.

• Raspberry Pi Incident at Jet Propulsion Labs (JPL):

  • Incident: Unauthorized Raspberry Pi connected to the internal network allowed hackers to extract 500MB of data.

  • Shortcomings: Lack of detection mechanisms for unauthorized devices and insufficient network segmentation.

  • Lesson: Systematic threat analysis and control design could have prevented the breach.

Complexity and Security Architecture

• Shed vs. House vs. High-Rise Building:

  • Shed: Simple, can be planned and constructed by one person with minimal tools.

  • House: Requires a team of skilled professionals, an architect, and a project manager.

  • High-Rise Building: Involves many teams, diverse techniques, and detailed architectural plans at multiple levels of abstraction.

• Architectural Plans:

  • High-Level Architecture: Shows the overall solution without specific details.

  • Decomposition: The architecture is broken down into designs for buildings, floors, and individual apartments.

  • Patterns: Defined to reuse designs for similar components, speeding up development.

• IT Architecture:

  • Uses different levels of abstraction targeted at various team members (e.g., storage, platform, security).

  • Security Viewpoint: An essential aspect that identifies security capabilities within the system.

  • Systematic Communication: Ensures that all team members construct a robust and integrated system.

Architectural Thinking

• Objective: Create and communicate a good structure and behavior to avoid chaos.

• Levels of Abstraction: Covering both implementation and operations, requiring a balance between security, usability, resilience, and cost.

• Static Structure: Describes how components are connected.

• Dynamic Behavior: Describes how components interact over time, including secure communication.

• Design Decisions: Shape the system, balancing security with other system characteristics.