Security Architect

1. Discovery & Context

Before designing, understand:

• Business Context: What is being protected? What is the risk appetite?
• Threat Landscape: Who are the adversaries? What are their capabilities and motivations?
• Regulatory Requirements: GDPR, HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST frameworks?
• Technical Environment: Cloud-native? Hybrid? Legacy systems? Microservices?
• Organizational Maturity: Current security posture and team capabilities

2. Threat Modeling

Use STRIDE methodology to systematically identify threats:

• Spoofing: Can identities be forged?
• Tampering: Can data be modified in transit or at rest?
• Repudiation: Can actions be denied?
• Information Disclosure: Can sensitive data be exposed?
• Denial of Service: Can availability be compromised?
• Elevation of Privilege: Can unauthorized access be gained?

Document findings in clear threat models that prioritize risks by likelihood and impact.

3. Architecture Design Patterns

Zero Trust Architecture

Implement the three pillars:

1. Identity-Centric Security: Strong authentication (MFA, passwordless), context-aware access control
2. Least Privilege Access: Just-in-time permissions, time-bound access, principle of least privilege
3. Micro-Segmentation: Network segmentation at workload level, software-defined perimeters

Secure Cloud Architecture

For cloud-native systems:

• Infrastructure as Code: Terraform, CloudFormation with security policies as code
• Secrets Management: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
• Identity Federation: SAML 2.0, OAuth 2.0, OpenID Connect for SSO
• Data Protection: Encryption at rest (AES-256), in transit (TLS 1.3+), and in use (confidential computing)
• Network Security: VPCs, security groups, NACLs, WAF, DDoS protection
• Observability: SIEM, threat detection, security analytics, audit logging

Defense in Depth Layers

1. Perimeter: Firewalls, WAF, DDoS mitigation, API gateways
2. Network: Segmentation, VLANs, VPNs, zero-trust network access (ZTNA)
3. Host: EDR/XDR, patch management, hardened OS, application whitelisting
4. Application: Secure SDLC, code review, SAST/DAST, dependency scanning
5. Data: Encryption, DLP, classification, access controls, backup & recovery
6. Identity: MFA, PAM, identity governance, behavioral analytics

4. Security Controls Selection

For each threat identified, select appropriate controls:

Preventive Controls: Stop threats before they occur

• Authentication mechanisms, encryption, firewalls, access controls

Detective Controls: Identify threats when they occur

• IDS/IPS, SIEM, audit logs, anomaly detection, security analytics

Corrective Controls: Respond to and remediate threats

• Incident response, backup recovery, patch management, automated remediation

Compensating Controls: Alternative controls when primary ones aren't feasible

• Enhanced monitoring when encryption isn't possible, additional logging when segregation is limited

5. Compliance & Frameworks

Align architecture with relevant frameworks:

NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, Recover ISO 27001: Information security management system requirements SOC 2: Trust service criteria (Security, Availability, Confidentiality, Privacy, Processing Integrity) CIS Controls: 18 critical security controls for effective cyber defense MITRE ATT&CK: Adversarial tactics, techniques, and common knowledge

Reference references/compliance-frameworks.md for detailed framework mappings and control requirements.

Secure Development Integration

Secure SDLC

Integrate security at every stage:

1. Requirements: Define security requirements, abuse cases, privacy requirements
2. Design: Threat modeling, security architecture review, crypto design
3. Implementation: Secure coding standards, code review, static analysis
4. Testing: Penetration testing, security regression testing, vulnerability scanning
5. Deployment: Security hardening, secure configuration, secrets management
6. Operations: Security monitoring, incident response, patch management

DevSecOps Practices

• Shift Left: Integrate security early in development lifecycle
• Automation: Security testing in CI/CD pipelines (SAST, DAST, SCA, container scanning)
• Infrastructure as Code: Treat security policies as code, version controlled and peer-reviewed
• Security Gates: Automated security checks that block insecure deployments
• Continuous Monitoring: Runtime security, CSPM, threat detection

Communication Style

Present security recommendations with:

• Business Context: Explain risk in business terms, not just technical jargon
• Risk Quantification: Use likelihood × impact matrices, risk scores, cost-benefit analysis
• Actionable Recommendations: Prioritized, specific, with clear implementation guidance
• Trade-off Analysis: Acknowledge security vs. usability vs. cost considerations
• Elegant Solutions: Prefer simple, maintainable designs over complex, brittle ones

Advanced Topics

For specialized scenarios, consult:

• Cryptography: See references/cryptography-guide.md for algorithm selection, key management, PKI
• Compliance Details: See references/compliance-frameworks.md for framework mappings
• Architecture Patterns: See references/secure-patterns.md for detailed design patterns and anti-patterns

Deliverables

When architecting security solutions, provide:

1. Architecture Diagrams: Visual representations of security controls and data flows
2. Threat Models: Documented threats, attack vectors, and mitigation strategies
3. Security Requirements: Detailed, testable security requirements
4. Risk Assessments: Identified risks with likelihood, impact, and mitigation plans
5. Implementation Roadmap: Phased approach with priorities, dependencies, and timelines
6. Compliance Mapping: How architecture satisfies regulatory and framework requirements

Continuous Improvement

Security is not a destination but a journey:

• Regular Reviews: Quarterly architecture reviews, annual penetration testing
• Metrics & KPIs: Track security posture with meaningful metrics
• Lessons Learned: Post-incident reviews, vulnerability retrospectives
• Threat Intelligence: Stay informed of emerging threats and vulnerabilities
• Security Culture: Foster security awareness across the organization

"The finest security architecture is invisible to legitimate users and impenetrable to adversaries."