Module 2 · Unit 4 · 7 Lessons
COMP 6660 · Enterprise Cybersecurity Enterprise Security Architectures and Technologies
Moves from adversary to defender: the architectural principles, network controls, and detection technologies that constitute an enterprise security architecture and its security operations function.
01 Unit overview
Unit 3 examined how enterprises are attacked. Unit 4 examines how they are architected to resist, detect, and contain those attacks.
The unit opens with security architecture principles — how enterprises define security domains, trust boundaries, and control placement in a way that aligns with business and technology strategy. Students learn to reason about architecture as a set of trade-offs rather than a checklist of products, and to document architectural decisions defensibly.
Defence-in-depth is then treated seriously rather than as a slogan: layered controls, redundancy, compensating controls, and the reality that perimeters no longer contain the enterprise. This motivates the network security material that follows — network security protocols (TLS, IPsec, SSH, DNSSEC and their legacy counterparts), virtual private networks for site-to-site and remote access, and firewalls and segmentation including next-generation firewalls, DMZ design, micro-segmentation, and east–west traffic control.
The unit then turns to detection. IDS and IPS are examined through signature and anomaly detection, sensor placement, tuning, and the economics of false positives. That discussion naturally extends into SIEM, XDR, and SOC operations: log aggregation, correlation, detection engineering, alert triage workflows, escalation, and SOC maturity models.
Throughout, the emphasis is on evaluating technologies against enterprise requirements — cost, operational load, coverage, and integration — rather than cataloguing features. Unit 4 provides the architectural vocabulary used in Assignment 2, Forum 4, and Part C of the final examination.
| Unit | 4 — Enterprise Security Architectures and Technologies |
|---|---|
| Module | Module 2 — Threats, Architecture, and Infrastructure Protection |
| Lessons | 7 (Lessons 4.1–4.7) |
| Discussion forum | Forum 4 — Enterprise Security Architectures |
| Assessed by | Assignment 2 (20%) — with Units 3 and 5 |
| Recommended weeks | Weeks 8–9 |
| Primary CLOs | CLO3, CLO4, CLO5 |
02 Unit learning outcomes
Upon completion of Unit 4, students will be able to:
Design
- Design enterprise security architectures using defence-in-depth and segmentation.
- Define security domains, trust boundaries, and control placement.
Evaluation
- Evaluate security technologies, including firewalls, VPNs, IDS, IPS, SIEM, and XDR.
- Assess detection coverage, operational load, and integration against enterprise requirements.
Recommendation
- Recommend appropriate controls for a given enterprise context.
- Document architectural decisions and their trade-offs.
Full statement
The authoritative unit learning outcomes, including their mapping to the nine course learning outcomes, are published on the Unit 4 learning outcomes page.
03 Lessons in this unit
Unit 4 contains seven lessons. Lessons 4.1–4.2 establish architectural principles; Lessons 4.3–4.5 cover network and boundary controls; Lessons 4.6–4.7 address detection and security operations.
Security Architecture Principles
Design principles, trust boundaries, security domains, and aligning architecture with business goals.
Topics: design principles · trust boundaries · security domains · business alignment
Lesson 4.2Defense-in-Depth
Layered controls, redundancy, compensating controls, and the limits of perimeter thinking.
Topics: layered controls · redundancy · compensating controls · perimeter limits
Lesson 4.3Network Security Protocols
Securing network protocols — TLS, IPsec, SSH, DNSSEC — and the risks of legacy protocol use.
Topics: TLS · IPsec · SSH · DNSSEC · legacy protocol risk
Lesson 4.4Virtual Private Networks
Site-to-site and remote-access VPNs, tunnel design, and the shift toward zero-trust access.
Topics: site-to-site VPN · remote access · tunnel design · zero-trust access
Lesson 4.5Firewalls and Segmentation
Next-generation firewalls, micro-segmentation, DMZ design, and east–west traffic control.
Topics: NGFW · micro-segmentation · DMZ · east-west traffic
Lesson 4.6IDS, IPS, and Threat Detection
Signature and anomaly detection, sensor placement, tuning, and the economics of false positives.
Topics: signature detection · anomaly detection · sensor placement · false positives
Lesson 4.7SIEM, XDR, and SOC Operations
Log aggregation, correlation, detection engineering, triage workflows, and SOC maturity.
Topics: SIEM · XDR · detection engineering · SOC maturity
04 Discussion and assessment
Forum 4 — Enterprise Security Architectures
Unit 4 hosts the fourth graded discussion forum. Contribute an initial posting of approximately 300–500 words supported by scholarly sources, plus at least two meaningful responses to classmates.
Example discussion topics:
- Security architecture patterns.
- SOC implementation.
- Cloud security architectures.
How Unit 4 is assessed
Unit 4 is assessed through Assignment 2 — Enterprise Threat Analysis and Security Architecture (20% of the final grade), which covers Units 3, 4, and 5.
Technical questions drawn from Unit 4 include:
- Design a secure cloud-migration architecture.
- Compare IDS, IPS, SIEM, and XDR.
- Design a defence-in-depth strategy for a financial institution.
Reading order
Lessons 4.1 and 4.2 establish the architectural framing used throughout the unit. Complete them before the network-protocol and detection lessons — especially if you intend to tackle the architecture design questions in Assignment 2.