Tutorial 5: Security Architecture and Defense in Depth

Unit 1 ยท Security foundations and risk

Objectives

Defense in depth assumes any one control can fail. Layer identity, network segmentation, application authorization, data protection, monitoring, and recovery. Independence matters: two controls that share one misconfiguration are not two effective layers.

request -> TLS -> identity check -> authorization policy
        -> input validation -> parameterized query
        -> audit event -> backup and recovery

Least privilege limits what an identity can do. Secure defaults deny access until explicitly granted. Fail-safe behavior protects the asset when a dependency is unavailable, while preserving usability where possible. Review architecture for blast radius: compromise of one service should not expose every tenant or administrative function.

Exercises

  1. Layer controls for a multi-tenant document service.
  2. Identify two controls that share a dangerous single point of failure.
  3. Design a deny-by-default permission model.

Self-check

  1. Why is one control insufficient?
  2. What does least privilege limit?
  3. What is blast radius?

Self-Check Quiz

1. What is a secure default?

AnswerA configuration that begins in the safer state, such as deny access, and requires an explicit decision to open it.

2. What reduces blast radius?

AnswerSegmentation, scoped identities, tenant isolation, minimal privileges, and independent recovery boundaries.

Homework

  1. Review a three-tier enterprise system for defense-in-depth gaps.
  2. Propose controls that remain useful if the perimeter is bypassed.
  3. Write a short architecture decision record with trade-offs.
Sample answer

A resilient design does not treat the firewall as the security boundary. It combines authenticated service calls, explicit object authorization, isolated data access, encrypted secrets, audit events, anomaly detection, and tested recovery. The decision record should state cost, operational complexity, and residual risk.