Security Architecture

Security architects design systems so they are secure by construction. This roadmap covers principles, trust boundaries, control selection and reference architectures. Several years of IT or security experience is recommended.

• Be comfortable with networks, identity and cloud basics
• Know at least one control framework
• Plan your study time

• CyberA4U Academy — courses

Principles such as least privilege, defense in depth, secure defaults, fail-safe design and simplicity guide every architectural decision.

• Explain core secure design principles
• Apply them to design decisions
• Use NIST SP 800-160 as a reference

Tools & tech: Architecture

• NIST SP 800-160 Vol. 1 Rev. 1 — Engineering Trustworthy Secure Systems

Trust boundaries are where data or control passes between different levels of trust — the places that need the strongest checks.

• Identify trust boundaries in a design
• Decide which checks belong at each
• Draw them in diagrams

Tools & tech: Architecture

• OWASP Threat Modeling Cheat Sheet

Controls are chosen from frameworks such as NIST SP 800-53 based on risk, cost and fit — not by ticking every box.

• Select controls based on risk
• Balance prevention, detection and response
• Document rationale

Tools & tech: Architecture

• NIST SP 800-53 Rev. 5 — Security and Privacy Controls

Reference architectures capture proven designs for common problems, so teams don't start from scratch.

• Use vendor reference architectures
• Adapt patterns to your context
• Create internal patterns

Tools & tech: Architecture

• AWS Security Reference Architecture

Data architecture classifies data, decides where it can live, and applies encryption, access control and monitoring according to sensitivity.

• Classify data by sensitivity
• Choose protection per class
• Design data flows that minimize exposure

Tools & tech: Architecture

• NIST SP 800-53 Rev. 5 — Security and Privacy Controls

Identity architecture centralizes authentication, standardizes authorization and protects privileged access across all systems.

• Design a central identity provider and SSO
• Plan authorization models
• Protect privileged and workload identities

Tools & tech: Architecture

• NIST SP 800-63-4 — Digital Identity Guidelines

Secure network architecture uses segmentation, controlled ingress and egress, and increasingly identity-aware access instead of trusting location.

• Design segmentation and zones
• Control ingress and egress
• Plan for zero trust access

Tools & tech: Architecture

• NIST SP 800-207 — Zero Trust Architecture

A landing zone is a pre-configured, secure multi-account cloud foundation with identity, logging, networking and guardrails built in.

• Explain landing zone components
• Compare provider offerings
• Plan guardrails and account structure

Tools & tech: Architecture

• AWS Control Tower — What is AWS Control Tower?
• Microsoft Cloud Adoption Framework — Azure landing zones

Architecture means trade-offs between security, cost, usability and speed. Good architects make them explicit and documented.

• Identify trade-offs in a design
• Compare options with clear criteria
• Record decisions and accepted risks

Tools & tech: Architecture

• NIST SP 800-160 Vol. 1 Rev. 1 — Engineering Trustworthy Secure Systems

Architecture reviews check new designs early, when changes are cheap, using threat modeling and a consistent checklist.

• Run a structured design review
• Use threat modeling to find risks
• Give actionable recommendations

Tools & tech: Architecture

• OWASP Threat Modeling Cheat Sheet

Useful security documentation is short, current and visual: diagrams, decision records and patterns that engineers actually read.

• Keep diagrams and decisions current
• Use architecture decision records
• Make documentation easy to find

Tools & tech: Architecture

• Threat Modeling Manifesto

Common anti-patterns include flat networks, shared admin accounts, security bolted on at the end, and single points of failure in controls.

• Recognize common anti-patterns
• Explain why they're risky
• Propose better patterns

Tools & tech: Architecture

• NIST SP 800-160 Vol. 1 Rev. 1 — Engineering Trustworthy Secure Systems

Check that you can design, document and review a secure architecture and defend its trade-offs.

• Apply design principles and trust boundaries
• Select controls based on risk
• Document and review designs

• CyberA4U CTF Arena — practice challenges

You can now think like a security architect. Continue with Zero Trust, Threat Modeling or Cloud security roadmaps, or certifications such as CISSP or SABSA.

• Keep your architecture portfolio
• Choose your next roadmap
• Mentor others on design reviews

• CyberA4U CTF Arena — practice challenges