Networks

The Ground

The corridors.

A mobility corridor is ground that permits movement at speed; an obstacle is anything that denies, delays or canalizes it. Corridors and obstacles are the same subject seen from the two sides, and a defender who understands the corridors chooses where an adversary is permitted to walk rather than trying to be strong everywhere.

The network layer is the only terrain in the model where a defender can genuinely shape the ground rather than merely occupy it. Identity determines whether a move is permitted; the network determines whether a permitted move is observed and where it emerges. This is why obstacle and canalization (M4) is the form of maneuver most native to this layer — the intent is not to stop lateral movement, which is not achievable, but to make it happen in an instrumented corridor of the defender’s choosing.

The metaphor’s discipline is that corridors are a property of the estate as built, not as diagrammed. A network diagram shows intent; the connection register shows corridors. Where they disagree, the register is the terrain.

Key Terrain

Key terrain is what confers decisive advantage if you hold it. Everything else on this layer is defended in order to hold these.

• TIC 3.0 access pointsThe declared crossings between the estate and everything outside it. Their value is that they are declared — an undeclared egress path is worth more to an adversary than any of them.
• Segment boundariesWhere policy is enforceable east-west. A boundary that exists only as an address range is a boundary an adversary does not have to cross.
• Cloud VPC peering and transitThe corridors that most often bypass the perimeter model entirely, because they were built by a platform team to solve a delivery problem.
• DNS resolution pathsThe one corridor almost every adversary uses and almost every estate permits by default.

The Decisive Point

The east-west boundary between the public tier and the mission tier

The decisive point is the east-west boundary between the public and mission tiers. Until an adversary holding a public-facing service crosses it, the foothold buys them very little.

It is decisive rather than merely important because it is the last boundary at which the defender still has both options. Before it, containment is cheap and the mission is unaffected. After it, the adversary is inside the tier where records live, and every subsequent defensive action trades mission availability for containment. The whole value of isolation and retrograde (M8) depends on the choice being made on the near side of this boundary.

It is also the boundary most likely to be quietly permissive, because the public tier legitimately needs to reach mission services to function. The question a decisive-point protection floor should ask here is not "is there a firewall" but "which named flows cross, who owns each, and when was the denied-path assumption last tested".

Sub-Towers, Rung by Rung

Maturity is scored here, not on the layer. Each rung below is stated for this sub-tower specifically — “Advanced” means something testable on each one, and something different on each one. The rung marked current is the illustrative position on the Federal Reference Agency profile.

Weight, Coverage and Residual Risk

Weight is criticality × exposure, 1–25 per sub-tower. Coverage is the weighted mean of the sub-towers’ maturity coverage — never a flat average. Residual risk is reported both as the inverse percentage and in weight points, because the points are what rank a backlog.

• 76Layer weightSum of criticality × exposure across 4 sub-towers
• 63.2%Rolled-up coverageWeighted mean of the sub-tower maturity coverage
• 36.8%Residual riskThe inverse of coverage, before weight is considered
• 28Residual pointsWeight left uncovered — the figure that ranks against other layers

Network assets are weighted by what crosses them, not by what they cost. A boundary device between the public tier and the data tier inherits the criticality of the records behind it; an access switch in an office inherits almost nothing. This is the layer where a naive asset-value weighting produces the most wrong answer.

Exposure on T3 has an unusual property: it is partly a defender’s choice. Segmenting reduces the exposure score of everything behind the new boundary, which means the same remediation shows up twice in the model — once as coverage on the Microsegmentation sub-tower, once as reduced exposure on the assets it now protects. Adopters should score exposure from the current state and let the recomputation show the second effect, rather than pre-crediting it.

The honest limit here is that segmentation coverage is the easiest figure in the whole model to overstate. A default-deny policy with two hundred standing exceptions scores as default-deny in every tool that reports it. This is why the sub-tower’s observable is the date each denied path was last tested, not the policy’s stated posture.

Maneuvers That Consume This Layer

The primary list is derived from each form’s own primary-terrain declaration in the maneuver catalog, so the two cannot disagree. The supporting list is authored: “consumes without being principally about” is a judgment, and deriving it would be a false claim of rigour.

Controls That Apply

Two lists. The first is specific to this ground; the second is the spine every layer runs through, stated once here rather than repeated ten times across the reference.

Specific to T3

• TM-4 Trust Zone DefinitionTrust-zone definition is the control that turns a network diagram into terrain with declared boundaries.
• TM-5 Connection and Denied-Path RegisterThe connection and denied-path register is the authoritative statement of which corridors exist and which are asserted closed — the second half is the part usually missing.
• KT-3 Avenue of Approach AnalysisAvenues of approach are drawn on this layer; almost every avenue in the reference profile is a network path plus an identity.
• KT-5 Barrier SufficiencyBarrier sufficiency is where a segmentation claim is tested rather than believed.
• SM-2 Maneuver AssignmentObstacle and canalization maneuvers are assigned to specific segments here; an unassigned maneuver is an intention.
• TA-4 Pre-authorized ResponseSevering a segment is a pre-authorized action or it is a forty-minute conference call. Which one it is decides whether M8 exists in this estate.
• FO-5 Statutory Availability FloorEgress and segmentation changes are the actions most likely to breach the statutory availability floor, so the floor has to be known before the action is authorized.

The Common Spine

• TM-1 Terrain Inventory and OverlayPuts the layer’s elements on the overlay in the first place. Nothing below can be computed for terrain that is not inventoried.
• TM-2 Defensive Layer ClassificationAssigns each element to a layer. This is the control that decides whether a thing is scored here or somewhere else.
• TM-3 Asset WeightingSets criticality and exposure per asset, which is the allocation driver every coverage and residual-risk number on the layer is weighted by.
• TM-6 Terrain CurrencyAges the overlay. A layer’s coverage figure inherits the staleness of the inventory it was computed from.
• TM-7 Terrain OwnershipNames an owner for the ground, so a coverage gap has somebody to be assigned to.
• KT-1 Decisive Point IdentificationIdentifies the decisive point on this layer rather than accepting the one this page names by default.
• KT-2 Decisive Point Protection FloorSets the minimum protection the layer’s decisive point must hold regardless of its rolled-up coverage.
• FO-7 Obligation Profile DeclarationDeclares which federal obligations bind the estate, which is what makes any FO coverage figure on this layer comparable to another agency’s.
• EN-1 Event Declaration and TriageAn engagement on this layer starts by being declared. Until it is, nothing below this line is running.
• EN-2 Engagement ReconstructionReconstruction is what establishes how far the adversary actually got across this layer, and it is what corrects the dwell estimate the layer’s tempo figures use.
• EN-3 Evidence PreservationSets how long this layer’s telemetry must survive — measured against estimated dwell, not against a retention default.
• EN-4 Escalation and Engagement AuthorityNames who may authorize action on this layer out of hours, which is where the decide segment is usually spent.
• EN-5 Eradication and Transition to RecoveryVerifies the adversary is off this layer before the mission is restored onto it.
• EN-6 Engagement CommunicationReports what happened on this layer to those who must know, inside and outside the agency.
• SM-7 Deception EmplacementDeception is emplaced per layer, on the approaches to that layer’s decisive point — the one detection here with no false-positive budget.
• CE-4 Coverage and Residual Risk ComputationPerforms the coverage and residual-risk computation described below, on the cycle cadence.
• CE-5 Remediation Backlog PrioritizationTurns weight multiplied by coverage gap into a ranked backlog, which is what the layer’s numbers are for.