Systems Architecture
Secure Architecture
Designing systems with security built in from the start.
- 10 notes
- 84 minutes of reading
- Secure by design principlesThe core principles of secure system design, such as least privilege, defence in depth, fail securely and secure defaults, and how to apply them across the development lifecycle. 8 min · Beginner
- Threat modelling with STRIDEA practical method for threat modelling a system: drawing a data flow diagram with trust boundaries, finding threats with STRIDE, rating them and choosing mitigations. 9 min · Intermediate
- Security zones and trust boundaries in system designHow to group systems into security zones by trust level, define trust boundaries, control the traffic between them, and apply the same ideas in on-premises, cloud and microservice designs. 8 min · Intermediate
- Identity-centric architectureWhy identity has replaced the network perimeter as the main security control, and how to design around a central identity provider, strong authentication, conditional access, workload identities and least-privilege authorisation. 8 min · Intermediate
- Encryption architecture and key managementHow to design encryption for data at rest, in transit and in use, using envelope encryption, key management services and HSMs, with sound key lifecycle, separation of duties and post-quantum planning. 9 min · Advanced
- Security logging architectureHow to design a security logging architecture: which sources to collect, how to transport, normalise, store and protect logs, retention and cost trade-offs, and how logging supports detection and investigation. 9 min · Intermediate
- Security reference architectures and SABSA overviewWhat security reference architectures are, how to use them without copying blindly, an overview of the SABSA business-driven method and its layers, and how it relates to TOGAF and zero trust models. 9 min · Advanced
- Designing a secure corporate network: scalability, redundancy, hierarchy and device selectionHow to plan a secure corporate network: what a design must document, designing for scalability and redundancy (STP, EtherChannel), the role of each hierarchical layer, choosing switches, routers and security appliances, and segmenting with subnets. 9 min · Intermediate
- Zero trust architecture and network segmentationWhy the old castle-and-moat model fails, the principles of zero trust, macro- and micro-segmentation, network access control with 802.1X, zero trust network access (ZTNA) replacing VPNs, and a practical roadmap. 8 min · Intermediate
- Zero Trust in plain wordsWhat Zero Trust really means, how it differs from the old perimeter model, and practical first steps for any organisation. 7 min · Intermediate