Digital Systems as Mission Terrain

Digital Systems as Mission Terrain

This lesson supplies the technical foundation used by every later case and planning exercise. Learners follow a transaction end to end, distinguish identity and cloud control planes from workloads, and build a system map that shows both observable evidence and operational consequence.

Follow a transaction before studying an intrusion

A cyber operation acts on systems that already perform work. Begin with one ordinary transaction: a planner opens a logistics application, an operator sends a command, or a citizen reads an emergency notice. Write the initiating person and device, requested name, destination service, identity decision, data used, response returned, and mission decision enabled. This prevents technical nouns from floating free of purpose.

Follow the transaction in sequence. The device obtains local configuration and selects a route. DNS translates a name into one or more addresses, often through recursive resolvers, authoritative servers, content-delivery networks, and cached answers. IP carries packets across routed networks; transport protocols provide connections or datagrams through numbered ports; TLS can authenticate an endpoint and protect content without hiding every observable fact. A proxy, load balancer, firewall, virtual network, service mesh, or carrier may make or enforce another decision before the application responds.

Treat each protocol field as evidence with limitations. A source address may identify a network exit rather than a person. A domain registration may be stolen, privacy protected, or deliberately misleading. A valid certificate shows that a validation process occurred; it does not prove benign ownership. A successful login shows that an accepted credential or token was presented, not necessarily that the legitimate human acted. Time synchronization, address translation, shared infrastructure, roaming devices, and retention periods all affect what can be reconstructed.

Practice by drawing the flow twice. The service path shows what must work for the transaction to succeed. The observation path shows where DNS queries, authentication events, network flows, endpoint activity, application requests, and administrative changes could be recorded. Mark where encryption reduces visibility and where a provider—not the organization—holds the evidence. Later modules will use the same two paths for targeting, collection, defence, and effects assessment.

Separate identities, machines, services, and control planes

Inventory systems by the function they perform, not only by product name. An endpoint is a user or operator device that runs processes, stores credentials, and crosses trust boundaries. A server provides a service but may be physical, virtual, containerized, or ephemeral. A directory or identity provider establishes principals, groups, authentication methods, sessions, tokens, application consent, and administrative roles. Its decisions can govern thousands of otherwise unrelated systems.

Cloud architecture adds an essential distinction. The control plane creates identities, networks, workloads, keys, policies, snapshots, and audit settings. The data plane performs the workload’s ordinary function. An operator with control-plane authority can sometimes change a system without logging into its operating system. SaaS shifts more infrastructure to the provider but leaves customers responsible for users, configuration, data, integrations, retention, and response coordination. IaaS exposes more operating-system and network responsibility. Hybrid environments join on-premises directories, cloud tenants, vendors, and remote administration into one trust graph.

Model authentication as a conversation. A claimant presents a factor or credential; an authority verifies it; a policy permits an action; a service accepts a session or token. Passwords, device certificates, hardware keys, API secrets, federation assertions, and recovery processes fail differently. Multi-factor authentication reduces some risks but can be weakened by token theft, malicious application consent, recovery abuse, session replay, or control-plane compromise. Privilege is a path assembled from roles, group membership, delegation, service accounts, and approval processes—not a single “admin” flag.

For every principal and service, record the owner, authenticating authority, authorized actions, credential lifetime, recovery route, administrative dependencies, and authoritative logs. Then ask what happens if the identity system is unavailable, dishonest, or partially compromised. CISA’s 2025 cloud-identity work highlights token validation, key management, secrets, logging, and forensic visibility because state actors exploit the seams between these functions.

Turn logs and controls into an operational picture

Controls prevent, constrain, reveal, contain, or help recover from unwanted change. Preventive controls include secure configuration, segmentation, patching, strong authentication, least privilege, application control, and protected administrative paths. Detective controls include endpoint telemetry, authentication and audit logs, DNS and network metadata, application events, integrity monitoring, provider alerts, and reports from people. Recovery depends on clean identity, tested backups, rebuild procedures, alternate communications, spares, knowledgeable staff, and authority to act.

Logging is useful only when the team can answer five questions: what event is recorded, at which point of view, with what identity and time quality, for how long, and who can alter it? Centralization supports correlation but also creates a high-value dependency. Retain the raw fields needed to test a conclusion; normalize carefully; protect administrative and deletion events; record gaps caused by licensing, encryption, sampling, or provider limitations. A dashboard is an interpretation of records, not the records themselves.

Build a minimum operational picture for one service. Include assets and owners; critical flows and dependencies; human and machine identities; security boundaries; authoritative time; preventive and recovery controls; telemetry sources and retention; normal behavior; alert and escalation paths; essential mission function; maximum tolerable degradation; and manual or alternate modes. CISA’s logging guidance emphasizes endpoints, servers, firewalls, and cloud services, but selection must follow the service model rather than a generic collection wish list.

Foundation exercise: choose an owned or fictional service and produce a one-page map. Trace one legitimate transaction, one failed authentication, one administrative change, and one service outage. For each event, identify the best evidence, an alternative explanation, the person able to make a response decision, and the consequence if the evidence is missing. This map becomes the learner’s reference system for later intelligence, targeting, effects, and resilience exercises.

Resources

• CISA Logging and Monitoring Guidance — Practical guidance for selecting, centralizing, protecting, and using logs from endpoints, servers, firewalls, and cloud services.
• CISA Core Cloud Identity Infrastructure — Current discussion of token validation, key and secrets management, control-plane trust, logging, and forensic visibility against advanced threats.