Build the wall before the house
A builder who adds the locks after the house is finished has to cut holes in the walls. A safe design is cheaper and stronger if security is planned at the start.
Today you learn what to ask before you design, and how to make an attack hard to start.
Key words
| Word | What it means |
|---|---|
| Network design | Planning how devices, links and services are put together. |
| Zero trust | A plan where nobody and nothing is trusted. Every access is checked. |
| Acceptable risk | The amount of risk an organisation agrees it can live with. |
| Use case | A description of how someone will use a system. |
| Supplier | A company that provides a product or service to another. |
| Attack surface | All the places where an attacker could try to get in. |
| Anonymise | Remove or change details so a person cannot be named. |
| Change control | A set routine where every change is approved and recorded. |
| Auditing | Checking records to see what happened. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can list what to establish before designing a system, and say how to make compromise difficult.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Step 1: establish the context
Before you draw anything, find out the facts. Use zero trust from the start: every access to the network is checked.
Also find out the system's purpose, how it must work and the acceptable risk. Then list the weaknesses that could affect it.
More context to gather
Think about how people will use the system. Write use cases. Ask what the supplier must do to keep it safe, and write that down.
Map the whole setup from end to end. Note how sensitive the data is and where it is kept, changed and shown.
Last, say who is responsible for each security risk. Nobody should be unsure.
Seven things to establish
| Question | Why it matters |
|---|---|
| Zero trust: is every access checked? | No device is trusted just for being inside |
| What is the system for, and what risk is acceptable? | Sets how strong the controls must be |
| What weaknesses could affect it? | You plan against real problems |
| How will people use it? | Use cases show risky habits early |
| What does the supplier do? | A weak supplier is a weak link |
| Where does the data live, from end to end? | Sensitive data needs the most protection |
| Who is responsible for what? | No gaps and no mix-ups |
The cells students fill in are left blank in this preview.
Check: the context
Have a go
Check: the context
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.