Security Data Archive Service¶
Illustrative Scenario
This example is intentionally generic and does not identify any particular storage platform, analysis product or organisation.
Scenario¶
A security operations function maintains a large archive of historical security data on an internal storage service.
A small number of authorised administrators require a management capability to browse, retrieve and manage archived information.
The environment is restricted, network paths are controlled and access permissions are enforced by the storage service.
Traditional Assurance View¶
Conventional assurance may examine:
- encryption in transit;
- authentication;
- authorisation;
- privileged access;
- object permissions;
- audit logging;
- software provenance; and
- administrative workstation security.
The ORSM Lens¶
ORSM asks whether the management solution remains proportionate to its narrow operational purpose.
Does additional security architecture materially reduce risk, or does it introduce more complexity and support burden than the service warrants?
Relevant Domains¶
- Protection Intent
- Complexity Management
- Operational Sustainability
- Human Factors
- Dependency Resilience
Key Questions¶
- What administrative functions are actually required?
- Which controls already exist at the storage, network and administrative layers?
- Does the management capability introduce unnecessary external dependencies?
- Can permissions be enforced by the underlying service rather than duplicated elsewhere?
- How difficult is the management component to patch and support?
- Is the operating model understandable to its administrator population?
- Does the proposed architecture preserve the simplicity of the original use case?
Illustrative Finding¶
The storage service may already provide the required authentication, transport protection and object-level authorisation.
Introducing additional intermediary services could duplicate existing protections while increasing support and recovery complexity.
Potential ORSM Outcome¶
Retain / Improve
Retain the simplest architecture that demonstrates adequate protection and operational supportability.
ORSM Lesson¶
A control does not become more effective merely because another control is placed in front of it.
Security benefit must justify architectural complexity.