Security architecture, trust, cryptography, and keys
LI systems are high-value targets for criminals, hostile states, insiders, and extortion. Security must protect confidentiality, integrity, authenticity, availability, accountability, and secrecy of case existence. Cryptography supports these properties but does not replace authorization or operational discipline.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| Zero-trust access | Every user/workload action is authorized from identity and context | Network location alone is insufficient |
| Mutual authentication | Both interface peers prove approved identity | Certificate validity is not endpoint authorization |
| Encryption | Protects data in transit and at rest | Keys, metadata, memory, and endpoints remain |
| Key management | Generates, stores, rotates, revokes, and destroys keys | Separate duties and hardware protection where justified |
| Integrity/signature | Detects unauthorized modification and supports provenance | Canonicalization and trust anchors matter |
| Threat modeling | Finds misuse and attack paths across trust boundaries | Repeat when topology or standards change |
Apply it as a controlled workflow
- Inventory assets including case existence, target scope, content, keys, audit, and availability.
- Model external, insider, supply-chain, and shared-infrastructure threats.
- Assign preventive, detective, containment, recovery, and oversight controls.
- Use narrow identities and just-in-time privileged access.
- Rotate trust without disabling validation or losing delivery.
- Run compromise, key loss, forged request, exfiltration, and denial exercises with synthetic data.
Evidence to demand
- No secret, identifier, or payload appears in general logs, tickets, metrics, or crash reports.
- Key use is policy-bound and independently audited.
- Software provenance, signing, dependency, and update controls protect the supply chain.
- Emergency access is time-bound, dual-approved where possible, and reviewed.
Failure to reason about
A valid TLS client certificate belongs to a decommissioned receiver. Cryptography succeeds, but authorization should fail because the endpoint is no longer approved. Maintain an independent endpoint registry and rapid revocation.
Feynman check
Encryption is an armored van. You still need a real court order, the right driver, the right destination, a route, and a receipt.