Module 2 · Unit 4 · Unit Overview
COMP 6660 · Enterprise Cybersecurity Unit 4 — Enterprise Security Architectures and Technologies
From adversary to defender. This page explains what the unit covers, how the seven lessons fit together, and what students are expected to be able to do at the end.
01 Purpose of this unit
Unit 3 examined how enterprises are attacked. Unit 4 examines how they are architected to resist, detect, and contain those attacks.
The unit is structured in three movements. The first — Lessons 4.1 and 4.2 — establishes architectural principles and the defence-in-depth model. This is conceptual groundwork: how to think about security domains, trust boundaries, and the placement of controls. It is deliberately positioned before the technology lessons because control selection without an architectural rationale produces expensive but ineffective security.
The second movement — Lessons 4.3 to 4.5 — covers network and boundary controls. Students examine how network security protocols actually work (TLS, IPsec, SSH, DNSSEC) and how they fail; how virtual private networks provide site-to-site and remote-access connectivity; and how firewalls, DMZ design, micro-segmentation, and east–west traffic control limit lateral movement once an attacker is inside.
The third movement — Lessons 4.6 and 4.7 — addresses detection and security operations. It examines IDS and IPS placement, signature and anomaly detection, tuning, and the economics of false positives; then extends into SIEM, XDR, and SOC operations: log aggregation, correlation, detection engineering, alert triage, escalation, and SOC maturity.
Throughout, the emphasis is on evaluating technologies against enterprise requirements — cost, operational load, coverage, integration — rather than cataloguing features. Unit 4 provides the architectural vocabulary used in Assignment 2, Forum 4, and Part C of the final examination.
Where this unit leads
The architectural reasoning developed in Unit 4 is applied in Unit 5 to platform-specific contexts (cloud, containers, endpoints) and revisited in Module 3 within governance and resilience discussions. The detection material in Lessons 4.6–4.7 is directly relevant to incident response in Lesson 6.7.
02 Topics covered
The unit addresses seven topics, each corresponding to one lesson. The topics are grouped into three blocks: architecture (4.1–4.2), network and boundary controls (4.3–4.5), and detection and operations (4.6–4.7).
| Block | Topic | Focus |
|---|---|---|
| Architecture | Security architecture principles | Design principles, trust boundaries, security domains, and aligning architecture with business goals. |
| Defense-in-depth | Layered controls, redundancy, compensating controls, and the limits of perimeter thinking. | |
| Network & boundary | Network security protocols | Securing network protocols — TLS, IPsec, SSH, DNSSEC — and the risks of legacy protocol use. |
| Virtual private networks | Site-to-site and remote-access VPNs, tunnel design, and the shift toward zero-trust access. | |
| Firewalls and segmentation | Next-generation firewalls, micro-segmentation, DMZ design, and east–west traffic control. | |
| Detection & ops | IDS, IPS, and threat detection | Signature and anomaly detection, sensor placement, tuning, and the economics of false positives. |
| SIEM, XDR, and SOC operations | Log aggregation, correlation, detection engineering, triage workflows, and SOC maturity. |
Reading strategy
Lessons 4.1 and 4.2 establish the architectural framing used throughout the unit. Complete them before the technology lessons — especially if you intend to tackle the architecture design questions in Assignment 2. The detection lessons (4.6–4.7) are best read after the network and boundary material, as they assume familiarity with the controls being monitored.
03 Lessons in this unit
Unit 4 contains seven lessons. Each provides readings, a set of core concepts, worked examples where useful, and one or more applied activities.
Lesson 4.1 — Security Architecture Principles
Introduces architecture as a set of trade-offs, not a checklist of products. Students learn to define security domains, place trust boundaries, and document architectural decisions defensibly.
Topics
- Design principles
- Trust boundaries
- Security domains
- Business alignment
Objectives
- Design enterprise security architectures.
- Align architecture with business goals.
Lesson 4.2 — Defense-in-Depth
Treats defence-in-depth seriously rather than as a slogan: layered controls, redundancy, compensating controls, and the reality that perimeters no longer contain the enterprise.
Topics
- Layered controls
- Redundancy
- Compensating controls
- Perimeter limits
Objectives
- Design layered defensive architectures.
- Justify defence-in-depth placement.
Lesson 4.3 — Network Security Protocols
Examines the protocols that secure network communication, and the legacy protocols whose continued use creates enterprise-scale risk.
Topics
- TLS
- IPsec
- SSH
- DNSSEC
- Legacy protocol risk
Objectives
- Evaluate network security protocols.
- Identify legacy protocol risk in enterprise environments.
Lesson 4.4 — Virtual Private Networks
Covers site-to-site and remote-access VPNs, tunnel design, and the shift toward zero-trust access as the perimeter model weakens.
Topics
- Site-to-site VPN
- Remote access
- Tunnel design
- Zero-trust access
Objectives
- Evaluate VPN architectures.
- Assess the shift from perimeter VPNs to zero-trust access.
Lesson 4.5 — Firewalls and Segmentation
Examines perimeter and internal traffic control, including next-generation firewalls, micro-segmentation, DMZ design, and east–west traffic control.
Topics
- Next-generation firewalls (NGFW)
- Micro-segmentation
- DMZ design
- East–west traffic control
Objectives
- Evaluate firewall and segmentation architectures.
- Recommend controls to limit lateral movement.
Lesson 4.6 — IDS, IPS, and Threat Detection
Examines detection technologies through signature and anomaly detection, sensor placement, tuning, and the operational economics of false positives.
Topics
- Signature detection
- Anomaly detection
- Sensor placement
- False positives
Objectives
- Evaluate IDS and IPS technologies.
- Assess detection coverage and operational load.
Lesson 4.7 — SIEM, XDR, and SOC Operations
Extends detection into security operations: log aggregation, correlation, detection engineering, alert triage, and SOC maturity models.
Topics
- SIEM
- XDR
- Detection engineering
- SOC maturity
Objectives
- Evaluate SIEM and XDR platforms.
- Assess SOC operations and maturity.
Suggested order
Read the seven lessons in sequence. Unlike the attack-class lessons in Unit 3, the Unit 4 lessons genuinely build on one another: firewall and segmentation decisions depend on architecture principles, and detection design depends on the controls being monitored. If you fall behind, it is better to read them in three short blocks (4.1–4.2, 4.3–4.5, 4.6–4.7) than to interleave them.
04 Key concepts
The concepts below are introduced or reinforced in Unit 4. Each is used again in Unit 5 (platform security) and Module 3 (governance, incident response, and resilience).
- Security architecture
- The structure of an enterprise's security controls, their placement within the technology estate, and the rationale that connects them to business requirements. Not a product catalogue; a set of documented decisions and trade-offs.
- Security domain
- A region of the enterprise estate subject to a consistent set of security requirements and controls. Domains are defined by trust boundaries and by the classification of the assets they contain.
- Trust boundary
- A line across which the level of trust changes. Controls are placed at trust boundaries because that is where privilege, identity, and data classification change.
- Defence-in-depth
- An architectural principle that places multiple, overlapping controls at different layers so that the failure of any single control does not compromise the enterprise. Assumes that any control can fail.
- Compensating control
- A control used in place of, or in addition to, a preferred control when the preferred control is not feasible. Must provide equivalent risk reduction and be documented as such.
- TLS (Transport Layer Security)
- The dominant protocol for securing data in transit. Provides confidentiality and integrity between endpoints. Misconfiguration — weak ciphers, expired certificates, unvalidated chains — is a common enterprise weakness.
- IPsec
- A suite of protocols for securing IP communications. Widely used for site-to-site VPNs. Operates at the network layer and can protect entire traffic flows rather than individual sessions.
- Micro-segmentation
- The practice of dividing a network into very small zones, each with its own access controls. Limits lateral movement by ensuring that compromise of one host does not grant access to adjacent systems.
- East–west traffic
- Traffic between systems within the enterprise estate (as opposed to north–south traffic entering or leaving it). Historically under-controlled; now a primary focus of segmentation and monitoring.
- IDS / IPS
- Intrusion Detection System (passive; alerts on suspicious traffic) and Intrusion Prevention System (inline; can block suspicious traffic). Both rely on signatures, anomalies, or behavioural models, and both require tuning to manage false positives.
- SIEM
- Security Information and Event Management. Aggregates and correlates logs from across the estate to support detection, investigation, and compliance reporting. Effectiveness depends as much on content and tuning as on the platform.
- XDR
- Extended Detection and Response. Integrates telemetry from endpoints, networks, cloud, and identity into a single detection and response platform. Reduces the integration burden that SIEM deployments often impose.
- SOC (Security Operations Centre)
- The function — people, processes, and technology — that monitors, detects, triages, and responds to security events. Assessed against maturity models that describe progression from reactive monitoring to proactive threat hunting.
05 How this unit is assessed
Forum 4 — Enterprise Security Architectures
Unit 4 hosts the fourth graded discussion forum. Contribute an initial posting of approximately 300–500 words supported by scholarly sources, plus at least two meaningful responses to classmates.
Example discussion topics:
- Security architecture patterns.
- SOC implementation.
- Cloud security architectures.
Assignment 2 — Threat Analysis and Security Architecture
Unit 4 material is weighted in Assignment 2 (20% of the final grade), which covers Units 3, 4, and 5.
Technical questions drawn from Unit 4:
- Design a secure cloud-migration architecture.
- Compare IDS, IPS, SIEM, and XDR.
- Design a defence-in-depth strategy for a financial institution.
| Outcome | Assessed by |
|---|---|
| Design enterprise security architectures | Assignment 2 (Q2, Q5); Final exam Part C |
| Evaluate security technologies | Forum 4; Assignment 2 (Q3); Final exam Part B |
| Recommend appropriate controls | Forum 4; Assignment 2 (Q5); Final exam Part C |
06 Study guidance
How long should Unit 4 take?
Budget approximately 25–30 hours across the two weeks allotted to the unit. This includes reading, note-taking, the lesson activities, the Forum 4 contribution and peer responses, and the architecture questions in Assignment 2.
Do I need hands-on experience with firewalls or SIEM platforms?
No. The unit examines these technologies conceptually and from an evaluation perspective. You are not required to configure firewalls, deploy SIEM, or operate a SOC. The emphasis is on understanding what each technology does, where it fits, and how to assess whether it meets enterprise requirements.
What is the relationship between Unit 4 and Zero Trust?
Zero Trust was introduced in Module 1, Lesson 2.7. Unit 4 provides the network and detection architecture that makes Zero Trust work in practice: segmentation, identity-aware firewalls, east–west traffic control, and continuous monitoring. Lesson 4.4 explicitly examines the shift from perimeter VPNs toward zero-trust access.
How does the detection material relate to Module 3?
Lessons 4.6 and 4.7 establish the detection capabilities that Module 3, Lesson 6.7 (incident response planning) assumes. Students who understand what a SOC actually does — how detection, triage, and escalation work in practice — will find the incident-response material substantially easier.
Where are the authoritative unit outcomes and mapping?
The Unit 4 learning outcomes page contains the full outcome statements and their mapping to the module and course learning outcomes. The course syllabus carries the authoritative assessment scheme and schedule.
Next
Continue to Unit 5 — Enterprise Systems and Infrastructure Security, which begins with operating system security in Lesson 5.1.