Unit
- Security architecture: A unified design that addresses the security requirements of an organization by integrating security controls into the overall IT architecture. It aligns business goals with risk management and compliance.
- Core objectives: Confidentiality, integrity, and availability form the CIA triad. Security architecture ensures data is accessible only to authorized parties, remains unaltered, and is available when needed.
- Relationship to enterprise architecture: Security architecture is a domain within enterprise architecture, alongside business, data, application, and technology architectures. It provides cross-cutting security considerations.
- Key stakeholders: Security architects collaborate with CISOs, network engineers, developers, and compliance officers. Their role involves translating security policies into technical controls.
- Artifacts produced: Diagrams, threat models, control matrices, and security standards are typical deliverables. These artifacts guide implementation and audit readiness.
- Lifecycle approach: Security architecture follows the same lifecycle as IT projects: plan, design, implement, operate, and retire. Each phase includes security review gates.
- Common pitfalls: Over-engineering controls without understanding business context, or under-engineering due to budget constraints. A balanced approach prioritizes high-risk areas.
- Standards and frameworks: ISO 27001, NIST SP 800-53, and the SABSA framework provide guidance. They offer structured methods for developing security architectures.
- Threat modeling: A systematic process to identify, categorize, and prioritize potential threats to the system. Methods like STRIDE or PASTA help uncover attack vectors and guide the placement of defensive controls.
- Defense in depth: A layered security strategy that uses multiple independent controls to protect assets. If one layer fails, others continue to provide protection, reducing the likelihood of a complete breach.
- Principle of least privilege: Users, processes, and systems should have only the minimum permissions required to perform their functions. This limits the blast radius of a compromised account and reduces insider threat risk.
- Separation of duties: Critical tasks are divided among multiple individuals to prevent fraud or error. Security architecture enforces this through role definitions, access controls, and audit trails that ensure no single person has unchecked authority.
- Compliance mapping: Security architecture maps organizational controls to regulatory requirements such as GDPR, HIPAA, or PCI DSS. This alignment ensures that design decisions directly support legal and contractual obligations during audits.
Code Example
YAML
security_policy:
encryption: AES-256
access_control: RBAC
logging: enabled
audit_frequency: quarterlyA simplified security policy snippet in YAML format. Such files define baseline controls and are used as input for architecture design.
Quick Revision
- Security architecture is a unified design integrating security controls with IT architecture.
- The CIA triad (confidentiality, integrity, availability) is the foundation.
- Security architecture is part of enterprise architecture and involves multiple stakeholders.
- Artifacts include diagrams, threat models, and control matrices.