Threat Model Thursday: Legible Architecture
[no description provided]
The image above is the frequency with which streets travel a certain orientation, and it's a nifty data visualization by Geoff Boeing. What caught my attention was not just the streets of Boston and Charlotte, but the lack of variability shown for Seattle, which is a city with two grids.
But then there was this really interesting tidbit, which relates to threat modeling:
Kevin Lynch defined “legible” cities as those whose patterns lend themselves to coherent, organized, recognizable, and comprehensible mental images. These help us organize city space into cognitive maps for wayfinding and a sense of place.
One of the questions I get all the time is 'what's the right way to model this system?' And the answer is the right way is the way that helps you find threats. A good system model balances detail with abstraction. It's laid out in a way that uses space and relative position to help the viewer follow a story.
Sometimes the underlying physical or logical reality makes that easy. Other times, the reality is more like the streets of Boston, and the official map draws a simple picture with the southern Red Lines being the same length, and similar visual portrayal of the Green Line. But the second map, from http://www.urbanrail.net/am/bost/boston.htm, shows a very different picture.
What's the right model? What's the legible architecture of a system?
Modeling a system that's grown organically over decades is a very challenging task. That's true of Windows, that's true of many large enterprise systems, that's true of the air traffic system. One of the advantages that cloud architectures bring is the opportunity to sweep away some of that historical complexity, and to create comprehensible models. That simplification carries value in terms of architectural consistency, makes it easier to impose checkpoints, and will be augmented over time with the accretion of complexity, inflexibility and eventually need to be swept away itself. That's rarely easy even when computers are like crops, rather than like pets.
As your threat modeling evolves, it's important to ask: what's the legible architecture of these systems?
That's emphatically not because legible architecture is a goal. It's a tool. Having understandable models of your systems makes it easier for everyone to interact with them, and that makes design easier, it makes evolution easier. Legible architecture is a property that makes other properties easier to achieve.