D. Protection¶
Controls that prevent harm, or contain it when it happens.
Take the Protection quiz when you have read the examples.
P36. Least privilege¶
The rule: give each person, service and process only the minimum access its function needs
Illustrative, not evidence.
Scenario. A small team runs the deployment pipeline for an online shop. The pipeline updates one web service in one cluster namespace.
Applying the rule. The pipeline role can only update deployments in that namespace. Every quarter a report lists each permission that went unused for 90 days, and the team removes them. No role holds an unused permission.
Violating the rule. The pipeline runs with cluster-admin rights because that was quicker to set up. It can delete any resource in any namespace, and nobody ever reviews what it uses. A leaked pipeline token now exposes the whole cluster.
Management variant.
Scenario. A company lets team leads approve purchases and look up staff records.
Applying the rule. Each lead has a written spending limit and sees only the data of their own team. Personal data stays visible to HR alone. A larger purchase goes to the next level.
Violating the rule. Every lead can approve any amount and open any employee file, because they are trusted. One careless lead can leak the whole payroll.
P37. Fail-safe¶
The rule: define a safe state, and design failure to move there (fail-safe; opposite: fail-dangerous)
Illustrative, not evidence.
Scenario. An admission webhook checks image signatures before a cluster starts a new workload. The webhook depends on a key service.
Applying the rule. The team writes down the safe state, which is to reject the request. In a failure test they stop the key service. The webhook rejects every request and raises an alert. The system reaches the defined safe state.
Violating the rule. Nobody defines what happens when the key service is lost. The webhook sometimes lets unsigned images through and sometimes hangs. The behavior is undefined, and it fails open when it matters most.
Management variant.
Scenario. A company approves production changes through a single change approver.
Applying the rule. The written default is that no change goes ahead without approval. A named deputy takes over when the approver is absent. A drill with the approver offline confirms it.
Violating the rule. When the approver is on leave, engineers go ahead on a chat message from anyone. The failure moves the process to the most dangerous state.
Real case: Clapham Junction rail crash (1988).
On 12 December 1988, a crowded commuter train ran into the rear of a stationary train near Clapham Junction, and 35 people died. During signalling work, an old wire was left connected at the fuse end and loose at the relay end. It made contact at a relay and gave a false feed of current that by-passed another relay, so signal WF138 showed a proceed aspect instead of red. The wiring errors were not found by the installer, his supervision or the testing before the signal was put into use. The independent wire count that practice and instructions called for was not done.
What it shows for P37. A signal's safe state is red. The wiring fault made it show a proceed aspect instead, a failure on the wrong side of safety, and the testing before the signal went back into use did not find it. A fail-safe design needs a test that shows a fault still takes the signal to red.
a crowded commuter train ran head-on into the rear of another which was stationary in a cutting just south of Clapham Junction station.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
As a result of the accident 35 people died and nearly 500 were injured, 69 of them seriously.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
signal WF138 would fail to turn to red and would instead show a proceed aspect.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
It would be a failure which falls on the wrong side of safety.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
At the fuse end even more surprisingly he did not disconnect the old wire at all.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
Although disconnected at the relay end the wire was left loose and made metal-to-metal contact at DM TRR, a false feed of current to by-pass DL TRR.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
it is actually an independent wire count that both good practice and Departmental Instructions called for.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
Those errors and their potential for disaster were not discovered by Mr Hemingway himself, were not discovered by any supervision of him, and were not discovered in the testing process before the signal was commissioned that evening and the line put back into public use next morning.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
It is those unusual and infrequent events that have to be guarded against by a system of independent checking of his work.
Source: Hidden: Investigation into the Clapham Junction Railway Accident (1989)
P38. Hierarchy of controls¶
The rule: use the highest possible control level: 1 eliminate; 2 minimize, substitute or moderate; 3 engineering control; 4 administrative control; 5 protective equipment; and act first at the source, then along the path, then at the receiver
Illustrative, not evidence.
Scenario. A risk review finds an administration port on an internal tool that every office laptop can reach.
Applying the rule. The team removes the port from the production build. Where a vendor tool still needs it, they bind it to localhost and write a record that says why removal was not possible. Each risk has such a record.
Violating the rule. The team adds a line to the README that says do not connect to the admin port. This warning is the only control. It depends on everyone reading it and remembering it.
Management variant.
Scenario. Staff share one login to a supplier portal, and an audit flags the risk.
Applying the rule. The company removes the shared account and gives each person a personal login with single sign-on. The risk cannot occur, so no reminder is needed.
Violating the rule. The company publishes a policy that says do not share credentials. The shared account stays in place, so the policy relies on personal care alone.
Real case: Bayer CropScience explosion and its MIC stockpile (2008).
On 28 August 2008, a pressure vessel (the residue treater) exploded in the pesticide unit of the Bayer CropScience plant in Institute, West Virginia. Two people were killed. Debris struck the blast blanket that shielded a nearby day tank of methyl isocyanate (MIC), but did not penetrate it. In 2009, a House committee asked the Chemical Safety Board (CSB) to study options to reduce or eliminate MIC. That year the company said MIC use would not be eliminated. In 2011 it announced it would end all production, storage and use of MIC.
What it shows for P38. The blast blanket, an engineering control around the MIC day tank, held against the debris. Ending all production, storage and use of MIC, as the company announced in 2011, removes the hazard at its source, the highest control level. In 2009 it had reported that MIC use would not be eliminated.
On August 28, 2008, at about 10:25 p.m., two Bayer CropScience employees at the Institute, West Virginia, manufacturing facility were asked to investigate why pressure was unexpectedly increasing in the residue treater
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
Pesticide Chemical Runaway Reaction Pressure Vessel Explosion (Two Killed, Eight Injured)
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
Small debris, including conduit, valves, small diameter pipe segments, and insulation, was thrown in all directions, some of which struck, but did not penetrate the MIC day tank blast blanket.
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
In May 2009, the U.S. House of Representatives Committee on Energy and Commerce sent a letter to the U.S. Chemical Safety Board Chairman requesting that the Board:
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
Conduct an investigation to determine options for Bayer to reduce or eliminate the use or storage of MIC by switching to alternative chemicals or processes.
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
In August 2009, the company reported that the use of MIC would not be eliminated at the facility and that in-situ production of MIC at the operating units where MIC is used was not a viable alternative.
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
On January 11, 2011, Bayer announced plans to end the production of both aldicarb and carbaryl by mid-2012 and thereby eliminate the production, storage, and use of all MIC and phosgene.
Source: CSB: Bayer CropScience pesticide runaway reaction and explosion investigation report (2011)
P39. Error-proofing¶
The rule: make the error impossible; if that is not possible, make the error visible immediately; if that is not possible either, limit its consequence so that it is survivable
Illustrative, not evidence.
Scenario. A postmortem shows that three different engineers ran a destructive migration against production when they meant to run it on staging.
Applying the rule. The migration tool now refuses a production target unless the command carries a change ticket number. The error is impossible by default. Where on-call must still act, a diff of the target is shown first, and a snapshot with a restore window limits the damage.
Violating the rule. The team sends an announcement that says please check the target before you run a migration. The guard is a reminder, so the same error can happen a fourth time.
Management variant.
Scenario. A purchasing team keeps receiving orders that have no contract number.
Applying the rule. The purchase system refuses to save an order that has no valid contract number. The error cannot enter the process, so nobody needs to catch it later.
Violating the rule. Finance checks a sample of orders each month and chases the gaps by hand. The system accepts the error, and the process relies on later inspection.
Real case: Hawaii false ballistic missile alert (2018).
On 13 January 2018, a warning officer at the Hawaii Emergency Management Agency (HI-EMA) sent a live ballistic missile alert to the public during a drill. The officer believed the drill was a real emergency. The software listed the test and live missile alerts on the same screen, and its confirmation prompt read the same for a test and a live alert. No second warning officer had to confirm the alert. The correction took 38 minutes.
What it shows for P39. The officer believed the drill was real, and nothing in the software made a live send stand out. Test and live alerts sat on the same screen, and the confirmation prompt read the same for both and did not show the message text. Where an error cannot be made impossible, it should at least be visible at once. The vendor then planned to clearly separate its test environment from its live one.
While the other warning officers understand that this is a drill, the warning officer at the alert origination terminal believes that this is a real emergency, not a drill.
Of particular relevance here, the drop-down menu listed the options for an internal “Test missile alert” together with the “Missile alert” message on the same screen.
The prompt contains the same message, irrespective of whether the message is a test or an alert, and it does not offer the officer an opportunity to review the message text that would be sent.
Prior to the morning of January 13, 2018, HI-EMA did not require confirmation from a second warning officer before sending a ballistic missile alert.
HI-EMA lacked procedures to prevent a single person from mistakenly sending a missile alert to Hawaiian public.
HI-EMA issues a CEM to correct the false alert 38 minutes after initial transmission.
HI-EMA’s alert origination software vendor intends to clearly differentiate its test environment from its live alert environment
P40. Defense in depth¶
The rule: use several independent and verified control layers (defense in depth)
Illustrative, not evidence.
Scenario. A company stores customer records in a cloud database.
Applying the rule. The records sit behind role-based access, a network policy and encryption at rest. The layers fail independently. The team tests each layer every quarter, so each critical asset has at least two verified layers.
Violating the rule. The only protection is the perimeter firewall. Once an attacker is inside, every record is open. A second layer exists on paper but nobody has tested it.
Management variant.
Scenario. A company wants independent oversight of access to its production systems.
Applying the rule. The platform team owns the access risk. The security team monitors it as a second line. Internal audit tests both as a third line. Each line is independent of the one below it.
Violating the rule. The platform team owns, monitors and audits its own access. All three jobs sit in one line, so a blind spot in that team stays hidden.
Real case: Target data breach (2013).
In 2013, attackers stole the information of as many as 110 million Target customers. A Senate committee staff report, based on media reports and expert analyses, describes several points where the attack could have been stopped. The attackers appear to have entered with a vendor's credential and moved to areas storing consumer data. Intrusion software warned of the malware, and the warnings appear to have gone unanswered.
What it shows for P40. The staff analysis, which rests on media reports and expert analyses, names several points where the attack could have been stopped: the vendor's credential, the isolation of sensitive networks, and the response to intrusion warnings. Each appears to have failed or gone unanswered. Defense in depth needs independent layers that are each verified to work, including the people who act on a layer's alerts.
stole the financial and personal information of as many as 110 million Target customers
Source: Senate Commerce Committee: A "Kill Chain" Analysis of the 2013 Target Data Breach (2014)
This report presents an explanation of how the Target breach occurred, based on media reports and expert analyses
Source: Senate Commerce Committee: A "Kill Chain" Analysis of the 2013 Target Data Breach (2014)
This analysis suggests that Target missed a number of opportunities along the kill chain to stop the attackers and prevent the massive data breach.
Source: Senate Commerce Committee: A "Kill Chain" Analysis of the 2013 Target Data Breach (2014)
Attackers who infiltrated Target’s network with a vendor credential appear to have successfully moved from less sensitive areas of Target’s network to areas storing consumer data, suggesting that Target failed to properly isolate its most sensitive network assets.
Source: Senate Commerce Committee: A "Kill Chain" Analysis of the 2013 Target Data Breach (2014)
Target appears to have failed to respond to multiple automated warnings from the company’s anti-intrusion software that the attackers were installing malware on Target’s system.
Source: Senate Commerce Committee: A "Kill Chain" Analysis of the 2013 Target Data Breach (2014)
P41. Compartments¶
The rule: divide the system into isolated compartments, so that one damaged compartment does not take down the whole system
Illustrative, not evidence.
Scenario. A software-as-a-service product serves many customers and has test, staging and production environments.
Applying the rule. Each environment has its own cloud account, and customers are served from separate cells with quotas. In a failure test the team floods one cell. All the other cells keep working.
Violating the rule. One shared database serves all tenants and all environments. A runaway test query slows production for every customer at once.
Management variant.
Scenario. A company starts a risky new product next to its core business.
Applying the rule. The new product runs with its own budget, its own stop criteria and its own legal entity. If it fails, the core business keeps its funds.
Violating the rule. The new product draws on the same budget line as the core product. A cost overrun there cuts funding for everything else.
Real case: Titanic's watertight compartments (1912).
Titanic's bulkheads were spaced so that the ship would stay afloat with any two compartments open to the sea. The damage it received flooded the four forward compartments and No. 6 boiler room. With five compartments flooded, water rose above the top of a bulkhead and flowed over into the next compartment, and so on in turn, until the ship sank.
What it shows for P41. The compartments held only while the water stayed below the tops of the bulkheads. Past that point, flooding in one compartment spilled into the next, so the damage spread through the whole ship. A compartment isolates a failure only up to the damage it was designed for. Evidence to the inquiry was that, with less damage, bulkheads carried up to C deck might have saved the ship.
Her bulkheads were spaced to enable her to remain afloat with any two compartments in communication with the sea.
Source: British Wreck Commissioner's Inquiry report: Titanic, Observations on the damage (1912)
But she could not remain afloat with the four forward compartments and the forward boiler room (No. 6) also flooded.
Source: British Wreck Commissioner's Inquiry report: Titanic, Observations on the damage (1912)
It has been shown that water came into the five forward compartments to a height of about 14 feet above the keel in the first ten minutes.
Source: British Wreck Commissioner's Inquiry report: Titanic, Observations on the damage (1912)
The flooding of these five compartments alone would have sunk the ship sufficiently deeply to have caused the water to rise above the bulkhead at the after end of the forward boiler room (No. 6) and to flow over into the next boiler room (No. 5), and to fill it up until in turn its after bulkhead would be overwhelmed and the water would thereby flow over and fill No. 4 boiler room, and so on in succession to the other boiler rooms till the ship would ultimately fill and sink.
Source: British Wreck Commissioner's Inquiry report: Titanic, Observations on the damage (1912)
It was stated in evidence that if No. 4 had not been damaged or had only been damaged to an extent within the powers of the pumps to keep under, then, if the bulkheads had been carried to C deck, the ship might have been saved.
Source: British Wreck Commissioner's Inquiry report: Titanic, Observations on the damage (1912)
P42. Two-person rule¶
The rule: require two authorized people at the moment of action (two-person rule)
Illustrative, not evidence.
Scenario. A platform team can delete production data. A deletion cannot be undone once the backup window has passed.
Applying the rule. The deletion tool needs a second authorized person to approve it live, at the moment of action. The system enforces this for every action on the critical list. One person cannot complete the deletion alone.
Violating the rule. One administrator can delete the production database alone. A single error, or a single bad actor, goes unchecked.
Management variant.
Scenario. A company releases large payments from its bank account.
Applying the rule. Any payment above a set amount needs two signatures when it is released. The bank system will not release the payment with one.
Violating the rule. One finance clerk can release any payment alone. A wrong amount or a fake invoice leaves the account before anyone else sees it.
Real case: Hawaii false ballistic missile alert (2018). Read the full case above.
What it shows for P42. A missile alert to the public is a critical action: once sent, it has reached the public, and the correction took 38 minutes. One warning officer could send it alone, and HI-EMA lacked procedures to stop a single person from sending it by mistake. The two-person rule asks for a second authorized person at the moment of sending.
P43. Segregation of duties¶
The rule: split the process so that no single person can request, approve, execute and record the same transaction; where the team is too small, add a compensating control (a later independent review)
Illustrative, not evidence.
Scenario. A four-person team runs a cloud account that holds customer data, and the possible loss is above the acceptable risk.
Applying the rule. A matrix lists incompatible roles. The engineer who requests production access cannot approve it. Nobody can grant themselves admin rights and also delete the audit log. Where the team is too small to split a step, a later independent review of the log is the compensating control. An access review finds nobody with two incompatible roles.
Violating the rule. One person can create a cloud account, grant themselves admin rights and delete the audit log. They can request, approve, execute and hide a transaction without anyone else involved.
Real case: Barings and the Singapore futures office (1995).
In February 1995, the Barings Group collapsed after large trading losses at Barings Futures Singapore (BFS). The head of BFS had traded without authority for about two and a half years. The inquiry by the Board of Banking Supervision found no separation between the front and back offices of BFS, and he effectively controlled both sides of the trading operation.
What it shows for P43. One person controlled both the trading and the back office that should have checked it, and his unauthorised trading went on for about two and a half years. The loss was far above any acceptable risk. Separating the front office from the back office splits these incompatible roles, and where a team is too small for that, an independent review of the records is the compensating control.
This followed the discovery of massive trading losses incurred by Barings Futures Singapore (BFS), an indirect subsidiary of the Barings bank, on Singaporean and Japanese exchanges.
Source: RBA Bulletin: Implications of the Barings Collapse for Bank Supervisors (1995)
It is now known, however, that Leeson had engaged, for a period of 2½ years, in unauthorised position – taking in Nikkei futures and Japanese Government Bond (JGB) futures on SIMEX and Osaka futures exchanges.
Source: RBA Bulletin: Implications of the Barings Collapse for Bank Supervisors (1995)
there was a lack of separation between the front and back offices within BFS.
Source: RBA Bulletin: Implications of the Barings Collapse for Bank Supervisors (1995)
As general manager of the company, Leeson effectively controlled both sides of the trading operation.
Source: RBA Bulletin: Implications of the Barings Collapse for Bank Supervisors (1995)
clear segregation of duties is fundamental to any effective control system;
Source: RBA Bulletin: Implications of the Barings Collapse for Bank Supervisors (1995)