10. Reference Architecture and Exercise Design

This chapter is not a configuration diagram for any specific product. It is a reference diagram of boundaries and responsibilities for an organization to review its own environment. Implementation should be varied according to size, regulation, cloud usage, operational capability, and existing contracts.

10.1 Reference Architecture: Separating Trust, Connecting Observation

What should be examined with this reference diagram is not reducing the number of arrows. It is being able to answer, for each arrow, who uses it, what authentication it requires, whether it is least privilege, whether logs are kept, whether it has an expiration, and whether it can be stopped in an anomaly.

10.2 Important Separation Patterns

Separating Everyday Use From Administrative Use

If the same endpoint is used for everyday email, web browsing, and document creation as for high-privilege identity administration, cloud configuration, and backup operations, the risk of everyday use connects directly to the management plane. Even where a fully separate physical endpoint is difficult, progressively strengthen dedicated accounts, endpoint health conditions, time limits, and recording of administrative operations.

Separating Production From Backup

If backup depends on the same identities, the same network, the same administrators, and the same encryption keys as production, then even though the backup is a copy, it does not become an independent recovery asset. Separate the access route, deletion privilege, retention changes, keys, administration console, and monitoring.

Separating the Organization From Outsourcing Partners

Enable outsourcing partners to access only what is needed, only when needed, with a record kept. Permanent VPNs, shared identities, and indefinite tokens make investigation, cutoff, and explanation harder, in exchange for convenience.

10.3 Exercise Scenario 1: Anomaly in a Privileged Identity

Situation

Late at night on a holiday, successful authentication of a privileged identity was observed from a region and device not normally used, and multiple privilege changes were recorded immediately afterward. No data encryption or ransom note has been confirmed.

Questions the Exercise Should Raise

1. Who receives this alert, and within how many minutes does a person confirm it?
2. Who approves suspending the account, invalidating the session, and revoking the privileged role?
3. On what basis is a normal administrative endpoint or emergency account trusted?
4. How far does the same identity reach — into cloud, on-premises, backup, and outsourcing partners?
5. When is an initial report, separating fact from hypothesis, sent to management?

Success Criteria

• The management planes that could be affected can be enumerated within one hour.
• Investigation and containment can be started via a normal alternate route.
• The necessary privilege suspension can be carried out without losing evidence.
• The explanation of impact to the business unit explicitly states what remains unconfirmed.

10.4 Exercise Scenario 2: Distrust of the Backup Management Plane

Situation

Anomalous file changes were found on a critical server, and an administrator login to the backup administration console was also recorded at the same time. The backup job still shows as successful.

Questions the Exercise Should Raise

1. What is the evidence for judging the backup to be safe?
2. If the production network is shut down, through which route can recovery assets be checked?
3. Which point-in-time backup is verified, in which isolated environment, by whom?
4. In what order are application, identity, DNS, certificates, and data integrity checked?
5. Who signs off on business resumption, and on what basis is resumption approved?

Success Criteria

• Confirmation does not rely on the backup-success notification alone, but checks retention, change history, and restoration.
• The identities and keys used for restoration are independent of the scope of the production compromise.
• The criteria for moving from limited resumption to normal resumption are shared with the business unit.

10.5 Exercise Scenario 3: Suspected Data Theft Involving an Outsourcing-Partner Connection

Situation

After an outsourcing-partner account accessed more data than usual, a change to external sharing settings was confirmed. Encryption is unconfirmed, and the outsourcing partner explains that it was performing maintenance work.

Questions the Exercise Should Raise

1. Under the contract, which logs, evidence trails, and contacts can be requested?
2. What is the business impact of halting the outsourcing-partner connection, and what is the fallback procedure?
3. Can the scope of externally shared data be cross-checked against records held by both the organization and the outsourcing partner?
4. What facts are needed to decide on notification to customers and regulators?
5. Is pursuing accountability from the outsourcing partner being confused with joint containment and evidence preservation?

Success Criteria

• Connection shutdown, evidence preservation, contractual communication, and business fallback can be started in parallel.
• The attacker’s claims and the outsourcing partner’s initial explanation are not treated as settled fact.
• Improvements can be fed back into the outsourcing-partner connection’s least privilege, expiration, and logging.

10.6 Conducting a Management Tabletop Exercise

A management exercise does not need to reproduce technical detail. Present the following decision points in chronological order, and confirm who decides what, and on what basis.

Producing the “correct answer” in the exercise is not the goal. The outcome is finding who holds authority, what information is needed before a decision can be made, and where communications get stuck.

10.7 Improvement Tracking Template

Do not close out an issue as “insufficient training.” Separate out where the shortfall lies — people, procedures, technology, privilege, assets, contracts, or budget — and put in place a reproducible verification method.