4.4Security architecture

For a system architect, security design is not something to "bolt on" in a later phase—it must be built into the architecture from the earliest stage. The idea that securing the perimeter (a firewall, etc.) alone is enough no longer holds, given internal-network intrusions and the spread of cloud usage and remote work. This section builds the judgment to decide which countermeasures to place at which layer, given business requirements and risk, grounded in the two defensive philosophies of defense in depth and zero trust, the division of roles between authentication and authorization, and the secure-by-design mindset.

4.4.1Defense in depth and zero trust

• Defense in depth is a design philosophy that places independent countermeasures at each of several layers—network perimeter, server, application, and data—so that if one layer is breached, the others contain the damage. Relying on perimeter defense alone (a firewall only) leaves the interior undefended the moment the perimeter is breached, so layering different kinds of countermeasures at each layer (a perimeter firewall, server patch management, an application WAF, data encryption, and so on) is the key to reducing risk.
• Zero trust is an architectural mindset that places no implicit trust in the idea that "it is safe because it is the internal network," and instead verifies every access, whether from inside or outside the company, each time it occurs. Whereas perimeter defense and defense in depth assume "outside is dangerous, inside is safe," zero trust assumes that the internal network may already be compromised (or that the perimeter itself has become blurred, e.g., through remote work), and performs authentication, authorization, and device-state verification on every access. The two are not mutually exclusive; in practice it is common to combine them, building zero-trust-style verification into one of the layers of defense in depth.