jperezduerto.info
Security in depth · Unit 28 · Lesson 4 of 11
A trust boundary is not a network line
Distinguish an authenticated relay from authority to approve a business decision.
Helpful before thisThreat modeling: ask before building
After this lesson you can
- Identify a trust boundary when applicant-supplied information becomes an approval claim.
One idea. One situation. One reasoned decision.
Follow authority, not geography
A trust boundary marks a change in which claims a component may accept and what authority they carry. Components on the same host can have different purposes and permissions. Drawing separate boxes does not itself enforce that distinction; the receiving component needs an appropriate decision.
Read the supplied record
T1 describes a fictional club membership service.
| Component or fact | Supplied role |
|---|---|
| Applicant | Supplies form answers, including a claimed approval label |
| Intake relay | Validates format and forwards applications |
| Approval service | Records decisions from authorized reviewers |
| Deployment | Relay and approval service share a host |
| Receiving check | Relay identity is authenticated |
Assume the relay forwarded the form accurately and has authority only to submit applications. The applicant’s label remains a claim from the applicant. Authenticating the relay establishes a sender, not an authorized review decision.
The approval service should use its trusted reviewer decision record to determine approval. Format validation can establish that a field is understandable; it cannot establish who was entitled to decide its value.
Your diagram should mark the transition from submission data to approval state and name the evidence required there. An approved reviewer decision for the relevant application supports the transition; a copied label alone does not.
This record identifies a necessary design boundary, not proof that an incorrect approval occurred. Moving one component to another machine would not settle the authority question either. Review the actual identity, permitted operation, and source of each decision.
The key distinction: Knowing the messenger does not establish the authority of every message field.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What may the approval service conclude from T1’s authenticated relay identity?
Show the answer
Correct answer: The request came from the relay, but an applicant-supplied approval label is not an authorized approval. The relay is authorized to forward applications. Its authenticated identity does not turn applicant-controlled content into the reviewer’s decision.
Try it
- WriteDraw three labeled boxes for T1: applicant, intake relay, and approval service. Mark who supplies each claim, which component may approve membership, and the evidence required at that transition.