Controls bolted on at the end are expensive and leaky. Security architecture is the practice of deciding up front how a system is structured so that failures are contained and attacks are hard. The principles below (many from Saltzer and Schroeder's classic 1975 paper) apply to networks, applications and cloud alike. The Security Principles lab note covers CIA, DAD, the Bell-LaPadula/Biba/Clark-Wilson models and the ISO/IEC 19249 list; this page focuses on how the ideas fit together in a design.
Core Design Principles
| Principle | Meaning | Example |
|---|---|---|
| Defence in depth | Multiple independent layers so one failure is not fatal | Firewall + segmentation + EDR + MFA + backups |
| Least privilege | Minimum rights, for minimum time | Read-only service account; JIT admin (IAM) |
| Separation of duties | Critical actions need more than one person or component | Developer cannot deploy to production alone |
| Fail-safe / secure defaults | On error or by default, deny access | Firewall default deny; unconfigured apps start locked down |
| Economy of mechanism | Keep designs small and simple | Fewer components, fewer bugs |
| Complete mediation | Check authorization on every access, not only the first | Re-validate session and permissions on each API call |
| Open design | Security must not depend on secrecy of the design (Kerckhoffs) | Public, reviewed crypto algorithms; only keys are secret |
| Least common mechanism | Minimise shared components between users | Tenant isolation, separate databases |
| Psychological acceptability | Secure paths must be usable | Password manager, SSO instead of ten logins |
| Fail secure vs fail open | Decide per asset: a door lock for safety fails open, a vault fails closed | Document the choice |
Security through obscurity is acceptable only as an extra layer, never as the primary defence.
Defence in Depth
Policies, training, governance (administrative)
Perimeter: firewall, WAF, DDoS protection
Network: segmentation, IDS/IPS
Host: hardening, EDR, patching
Application: input validation, authN/Z
Data: encryption, DLP, backups
Layers should be diverse (different technologies or vendors) and cover prevent, detect and respond. Pair the preventive, detective and corrective types described in Security Controls.
Zero Trust
Traditional design trusts anything inside the network ("castle and moat"). Once an attacker crosses the perimeter via phishing or a VPN credential they move freely. Zero Trust removes implicit trust based on network location: never trust, always verify.
Core ideas (NIST SP 800-207):
- Verify explicitly: authenticate and authorize every request using identity, device health, location and behaviour.
- Least-privilege access: just enough, just in time, per resource.
- Assume breach: design, monitor and segment as if an attacker is already inside.
Common pillars: Identity, Devices, Networks, Applications and workloads, Data (plus visibility/analytics and automation). Practical building blocks are strong MFA, device posture checks, microsegmentation, policy enforcement points that gate each connection, and continuous logging. Trade-off: it is a journey, not a product, and has cost and usability limits. Lab-level comparison with "trust but verify" is in the Security Principles note.
Secure by Design and Privacy by Design
- Secure by design: threat-model during design, choose safe defaults, use memory-safe languages and vetted libraries, and ship hardened configurations out of the box rather than relying on the customer. See Threat Modeling and Security Requirements.
- Secure by default: the least-risky settings are on without user action.
- Privacy by design: collect only needed data, limit retention, protect by default and make privacy the default setting (a GDPR principle; see GDPR and Data Lifecycle).
Attack Surface Reduction
The attack surface is every place an attacker can reach or influence: open ports, exposed APIs, users, third-party code, forgotten servers. Shrink it by removing unused services, closing ports, deleting dormant accounts, limiting internet exposure, minimising dependencies and validating all input at the boundary. See Attack Surface and Vectors and System Hardening.
Trust Boundaries
A trust boundary is a line where the level of trust changes: internet to web server, web server to database, user mode to kernel, your service to a third-party API. Every crossing needs authentication, authorization and input validation, and is where threat modelling data-flow diagrams place their threats. Fewer, well-guarded boundaries are easier to defend.
Reference Architecture: Layered Network
INTERNET
|
[ DDoS / CDN / WAF ] <- trust boundary 1
|
[ Edge firewall ]
|
+------------ DMZ ------------+
| reverse proxy, web server, |
| mail gateway, DNS |
+-------------+---------------+
| <- trust boundary 2
[ Internal firewall ]
|
+-------------------+--------------------+
| Internal user VLAN | App tier VLAN | mgmt VLAN (PAM, jump host)
+-------------------+--------------------+
| <- trust boundary 3
[ Data-tier firewall ]
|
[ Databases / backups ] encrypted, no direct internet
How it applies the principles:
- Defence in depth: three independent filtering points plus WAF.
- Segmentation and least privilege: a compromised web server in the DMZ cannot talk to the data tier directly; only the app tier can, on specific ports (Network Segmentation).
- Default deny: firewalls permit only listed flows (Firewalls and IDS/IPS).
- Monitoring: IDS/IPS and logs at each boundary feed a SIEM.
- Management plane separated and reached only through a jump host with MFA.
A zero-trust variant keeps the same shape but also authenticates every east-west connection instead of relying on the zone alone.
Assume Breach
Design as though some control will fail or an insider is already hostile. Practical consequences: segment to contain lateral movement, encrypt data at rest and in transit, keep immutable offline backups, log centrally and off-host, rehearse incident response, and hunt rather than only wait for alerts. It complements prevention rather than replacing it.
Key Points
- Layer independent controls (defence in depth); default deny; check every access.
- Keep designs simple, public in design and minimal in privilege.
- Zero trust drops location-based trust and verifies identity, device and context per request.
- Build in security and privacy from the start; shrink the attack surface; guard trust boundaries.
- Segment the network into zones (internet, DMZ, internal, data) and assume breach.