🛡️ Security

Security wraps around every layer of the architecture — protecting identities, data, networks, applications, and supply chains. Modern security is not a perimeter; it's woven into every design decision, pipeline, and runtime environment.

🔐

Identity & Access

Who are you and what can you do?

Identity Provider (IdP)

Okta, Entra ID (Azure AD), Auth0, Keycloak, Ping

Centralised service that manages user identities, credentials, and authentication. Supports protocols like OIDC, SAML, and LDAP. Enables Single Sign-On (SSO) across all applications from a single login.

🏛️ Context: Every enterprise should centralise identity in one IdP. Evaluate Okta/Entra ID for cloud-first; Keycloak for open-source self-hosted. Enforce MFA universally. Plan for identity federation with partners and acquisitions.

OAuth 2.0 / OpenID Connect

OAuth2, OIDC, JWT, Access tokens, Refresh tokens

OAuth 2.0 is the authorisation delegation framework (granting apps limited access). OIDC adds an identity layer on top (proving who you are). Together they power modern API security, SSO, and social login.

🏛️ Context: OIDC + OAuth 2.0 is the standard for modern applications. Use authorisation code flow with PKCE for web/mobile. Short-lived access tokens + refresh tokens. Never store sensitive data in JWTs (they're base64, not encrypted).

Multi-Factor Authentication (MFA)

2FA, TOTP, WebAuthn, FIDO2, Passkeys

Requiring multiple verification factors: something you know (password), have (phone, security key), or are (biometrics). Passkeys (FIDO2/WebAuthn) are phishing-resistant and replacing passwords entirely.

🏛️ Context: Enforce MFA universally — it blocks 99%+ of credential-based attacks. Push for phishing-resistant methods: hardware keys (YubiKey) for admins, passkeys for all users. SMS-based 2FA is the weakest option.

RBAC / ABAC / Policy Engines

Role-Based, Attribute-Based, OPA, Cedar, Casbin

RBAC: permissions assigned by role (admin, editor, viewer). ABAC: access decisions based on attributes (department, location, time). Policy engines (OPA, Cedar) externalise authorisation logic into centrally managed rules.

🏛️ Context: RBAC is sufficient for most applications. ABAC enables fine-grained, context-aware access. OPA/Cedar externalise policy from code — enables consistent enforcement across services and simplifies auditing. Design for least privilege.

Privileged Access Management (PAM)

CyberArk, HashiCorp Vault, AWS IAM, Just-in-Time access

Controls and audits access to sensitive systems — admin accounts, databases, production infrastructure. Just-in-time (JIT) access grants elevated privileges temporarily, with approval workflows and full session recording.

🏛️ Context: Standing admin access is the #1 target for attackers. Implement JIT access for all production systems. Vault stores and rotates secrets (API keys, database credentials). Every privileged session should be logged and reviewable.

🔒

Data Protection

Keeping information confidential and integral

Encryption at Rest

AES-256, KMS, HSM, Transparent Data Encryption

Encrypting stored data so it's unreadable without the decryption key. Cloud KMS (Key Management Services) manage key lifecycle — creation, rotation, and destruction. HSMs provide hardware-backed key protection.

🏛️ Context: Enable encryption at rest for all storage by default — most cloud services support it natively. Use customer-managed keys (CMK) for sensitive workloads. Implement key rotation policies. Plan for crypto-agility (algorithm upgrades).

Encryption in Transit

TLS 1.3, mTLS, Certificate management, HTTPS

Encrypting data as it moves between systems. TLS secures client-to-server communication. mTLS (mutual TLS) adds server-to-server authentication — both sides verify each other's identity. Certificate management handles the lifecycle.

🏛️ Context: TLS 1.3 everywhere, no exceptions. mTLS for service-to-service communication (service mesh automates this). Automate certificate issuance and rotation with cert-manager and ACME (Let's Encrypt). Plan for short-lived certificates.

Secrets Management

HashiCorp Vault, AWS Secrets Manager, Azure Key Vault

Securely storing and distributing sensitive credentials — API keys, database passwords, certificates, tokens. Secrets are never hardcoded in code or config files. Dynamic secrets are generated on-demand with automatic expiration.

🏛️ Context: Vault is the gold standard for secrets management. Dynamic secrets (generated per session, auto-expire) eliminate the shared credential problem. Integrate with CI/CD — pipelines pull secrets at runtime, never store them.

Data Classification & DLP

Data Loss Prevention, PII detection, Data masking

Categorising data by sensitivity (public, internal, confidential, restricted) and enforcing handling rules per classification. DLP tools detect and prevent sensitive data from leaving controlled boundaries.

🏛️ Context: Classification drives protection strategy: not all data needs the same controls. Automate PII detection in data pipelines. Implement dynamic data masking for non-production environments. DLP at email, endpoint, and cloud storage.

🧱

Network & Infrastructure Security

Defending the perimeter and beyond

Zero Trust Architecture

Never trust, always verify, BeyondCorp, ZTNA

Security model that eliminates implicit trust. Every request is verified regardless of network location. Identity-based access replaces network perimeter. Microsegmentation, continuous authentication, and least-privilege access.

🏛️ Context: Zero trust is the target architecture — migrate incrementally. Start with identity (strong AuthN for all users), then microsegmentation, then device trust. Google's BeyondCorp is the reference implementation. VPN is not zero trust.

Web Application Firewall (WAF)

AWS WAF, Cloudflare WAF, ModSecurity, Imperva

Inspects HTTP/HTTPS traffic and blocks common web attacks: SQL injection, cross-site scripting (XSS), request forgery, bot traffic. Rules can be managed (vendor-provided) or custom. Sits in front of web applications.

🏛️ Context: WAF is table stakes for public-facing applications. Use managed rulesets as baseline and add custom rules for application-specific patterns. Combine with rate limiting and bot management. Log all blocked requests for analysis.

DDoS Protection

AWS Shield, Cloudflare, Akamai Prolexic, Azure DDoS

Defending against Distributed Denial of Service attacks that overwhelm systems with traffic. Cloud-based DDoS protection absorbs volumetric attacks at the edge. Application-layer DDoS requires WAF rules and rate limiting.

🏛️ Context: L3/L4 DDoS protection is built into most cloud providers at no extra cost (AWS Shield Standard). L7 (application-layer) DDoS is harder — requires WAF, rate limiting, and CDN. Design for graceful degradation under attack.

Network Segmentation

VPC, Subnets, Security Groups, Microsegmentation

Dividing the network into isolated zones with controlled traffic flow between them. Public subnets face the internet; private subnets are internal-only. Microsegmentation applies per-workload network policies.

🏛️ Context: Design network architecture around trust boundaries, not convenience. Public → DMZ → Application → Data tiers. Default-deny between segments. In Kubernetes, use NetworkPolicies to enforce pod-to-pod restrictions.

🔍

Application & Supply Chain Security

Securing the code and everything it depends on

SAST — Static Analysis

SonarQube, Semgrep, CodeQL, Checkmarx

Scanning source code for security vulnerabilities without executing it. Finds issues like SQL injection, hardcoded secrets, insecure deserialization, and unsafe functions. Runs in CI and IDE for immediate feedback.

🏛️ Context: SAST in CI is a baseline requirement. Semgrep offers fast, customisable rule writing. CodeQL (GitHub) provides deep semantic analysis. Tune rules to reduce false positives — noisy tools get ignored.

SCA — Software Composition Analysis

Snyk, Dependabot, Trivy, OWASP Dependency-Check

Scanning third-party dependencies for known vulnerabilities (CVEs) and licence compliance issues. Critical because 80%+ of application code comes from open-source libraries. Automated PR generation for vulnerable dependency updates.

🏛️ Context: SCA is essential — dependency vulnerabilities (Log4Shell, etc.) are the most exploited attack vector. Automate with Dependabot/Renovate for update PRs. Pin dependency versions. Use private registries to control what enters your codebase.

DAST — Dynamic Testing

OWASP ZAP, Burp Suite, Nuclei, HCL AppScan

Testing running applications for vulnerabilities by sending crafted requests — simulating an attacker. Finds issues SAST cannot: misconfigured headers, authentication bypasses, runtime injection flaws. Complements static analysis.

🏛️ Context: Run DAST against staging environments in CI/CD. OWASP ZAP is the open-source standard. For API security, combine DAST with API-specific tools. Annual penetration testing supplements automated DAST.

Container & Image Security

Trivy, Snyk Container, Cosign, SBOM, Notary

Scanning container images for OS and library vulnerabilities. Image signing (cosign) verifies provenance. SBOMs (Software Bill of Materials) inventory every component. Admission controllers block unscanned/unsigned images from running.

🏛️ Context: Scan on build AND continuously (new CVEs against existing images). Generate SBOMs for every image (SPDX or CycloneDX format). Enforce image signing in Kubernetes admission policies. Use minimal base images.

SBOM & Supply Chain

Software Bill of Materials, SLSA, Sigstore, in-toto

An SBOM is a complete inventory of components in a software artifact. SLSA (Supply-chain Levels for Software Artifacts) is a framework for supply chain integrity — from source to build to deployment. Sigstore provides keyless signing.

🏛️ Context: SBOMs are increasingly mandated by regulation (US Executive Order 14028, EU CRA). SLSA Level 2+ ensures builds are reproducible and tamper-evident. Integrate SBOM generation into CI/CD as a standard artifact alongside the image.

📋

Governance, Risk & Compliance

Meeting regulatory and organisational requirements

Compliance Frameworks

SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS, NIS2

Regulatory and industry standards governing security controls, data handling, and privacy. SOC 2 certifies security practices. ISO 27001 is the international standard. GDPR/HIPAA govern specific data types. PCI DSS covers payment data.

🏛️ Context: Map compliance requirements to architecture early — they're constraints, not afterthoughts. Automate evidence collection for audits. Continuous compliance (Vanta, Drata) replaces annual audit scrambles. Understand which frameworks apply to which systems.

SIEM & Security Operations

Splunk, Sentinel, Chronicle, QRadar, Elastic SIEM

Security Information and Event Management — collecting, correlating, and analysing security events from across the estate. Detects threats, triggers alerts, and provides forensic investigation capabilities. The nerve centre of the SOC.

🏛️ Context: SIEM is essential at enterprise scale. Cloud-native (Sentinel, Chronicle) reduces operational burden. Focus on detection rules that matter — too many alerts cause fatigue. Integrate with SOAR for automated incident response.

Threat Modelling

STRIDE, MITRE ATT&CK, Attack trees, Abuse cases

Systematically identifying security threats during design. STRIDE categorises threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). MITRE ATT&CK maps real-world attack techniques.

🏛️ Context: Threat modelling during architecture review is far cheaper than fixing vulnerabilities post-deployment. Make it a standard phase in design. STRIDE for application threats; MITRE ATT&CK for infrastructure threats. Document and revisit as the system evolves.

Audit Logging & Forensics

CloudTrail, Azure Activity Log, Audit logs, Chain of custody

Immutable records of who did what, when, and where. Covers user actions, admin operations, data access, and configuration changes. Essential for compliance, incident investigation, and non-repudiation.

🏛️ Context: Log everything meaningful, retain based on compliance requirements (7 years for some financial regulations). Ensure logs are tamper-evident (write-once storage). Centralise audit logs separately from application logs for integrity.

Security Architecture Principles

Defence in Depth

Multiple layers of controls — no single point of failure. If the WAF misses an attack, input validation catches it. If that fails, authorisation prevents access. If that fails, encryption protects the data.

Least Privilege

Grant the minimum permissions necessary for the task, for the minimum time. Applies to users, services, and infrastructure. Standing admin access is a risk — prefer just-in-time elevation.

Shift Left

Move security earlier in the development lifecycle. Secure coding training, SAST in the IDE, SCA on commit, threat modelling in design. Issues found early cost orders of magnitude less to fix.

Assume Breach

Design as if attackers are already inside the network. Encrypt internal traffic. Segment networks. Monitor for lateral movement. This mindset drives robust detection and containment architectures.

Secure by Default

Default configurations should be secure. Encryption on. Ports closed. Access denied. MFA required. Developers should have to opt out of security, not opt in. Platform engineering enforces this through golden paths.

Shared Responsibility

In cloud, the provider secures the infrastructure; you secure your workloads. The boundary shifts with IaaS/PaaS/SaaS. Every team must understand exactly what they're responsible for securing.

How Security Connects (Everywhere)

🏢

Infrastructure (Layer 1): Network firewalls, segmentation, physical security, DDoS protection, and encryption of storage volumes. Infrastructure is the outermost defence ring.

🖥️

Platform (Layer 2): OS hardening, patching, supply chain security (SCA), container image scanning, and secrets in version control prevention. The platform must be secure before apps deploy on it.

🗄️

Data (Layer 3): Encryption at rest, access controls on databases, data classification, masking in non-production, and compliance with data residency and retention regulations.

☁️

Cloud & DevOps (Layer 4): Shift-left security in CI/CD, policy as code, IAM for cloud resources, container scanning, and secrets management. DevSecOps embeds security into the delivery pipeline.

🔌

Integration (Layer 6): API authentication (OAuth), mTLS between services, message encryption, webhook signature verification, and secure file transfer protocols.

🖥️

Application (Layer 7): Input validation, OWASP Top 10 prevention, authentication flows, authorisation enforcement, and SAST/DAST scanning of application code.