architecture_intro.md

title	Security Architecture
short_title	Security Architecture

Introduction

Security Architecture is a cornerstone of Security by Design, providing the structured approach needed to embed security consistently across systems, rather than addressing it in an ad hoc or reactive manner. It ensures that security is not confined to individual components, but is considered holistically across the entire organisation and its technology landscape.

At the enterprise architecture level, Security Architecture aligns security with business strategy, risk appetite, and regulatory obligations. It defines overarching principles, standards, and governance models that guide how security should be implemented across all business units and systems. This ensures consistency, interoperability, and a shared understanding of security objectives.

At the technical architecture level, Security Architecture translates these principles into concrete patterns, controls, and mechanisms. This includes decisions around identity and access management, network segmentation, encryption, monitoring, and secure integration between systems. It provides reusable building blocks that enable teams to design and deploy secure solutions efficiently and consistently.

:::{important} It is important to distinguish Security Architecture from software design. While software design focuses on the internal structure and behaviour of individual applications—such as code structure, algorithms, and component interactions—Security Architecture operates at a higher level. It defines how security is applied across systems and environments, guiding multiple applications and technologies to work together securely. :::

In a Security by Design approach, Security Architecture ensures that security is scalable, repeatable, and aligned with both business needs and technical realities. Without it, security decisions risk becoming fragmented, inconsistent, and difficult to maintain over time.

Learning Objectives

By the end of this section, you will be able to:

• Define the role of a Security Architecture within both enterprise and technical levels
• Distinguish between Security Architecture and software design
• Identify common security architecture building blocks and patterns
• Create a Security Architecture that aligns with business strategy, risk appetite, and regulatory obligations
• Apply Zero Trust Architecture principles within a Security by Design framework
• Design security logging mechanisms that support monitoring, detection, and forensic analysis
• Develop a practical Security Architecture example, including an RBAC outline

+++{"no-pdf": true}

Sections

:::{toc} :context: children :::

+++

:::{raw:typst} Sections

In the following section you learn how to create a Security Architecture:

• Security Architecture - What and How
• Common Security Architecture Building Blocks
• Steps to Create a Security Architecture
• Zero Trust Architecture and Security By Design
• Security Logging
• Security Architecture Example
• Example Architecture - RBAC outline :::