Architecture · Security Architecture
Security Architecture
The deliberate arrangement of controls across identity, endpoints, applications, data, network and infrastructure, aligned to a maturity model.
AdvancedUpdated 2026-09-01
Overview
Security architecture maps controls to layers and to functions, prevent, protect, detect, respond, recover, so coverage and gaps are visible. It converts a collection of products into a defensible design with known assumptions.
It should also record what is deliberately not protected and why. Unstated acceptance is the most common form of unmanaged risk.
Layer model
Prevent
Phishing resistant MFALeast privilege and JITHardened baselinesApplication controlSegmentationEmail and web filtering
Protect
Encryption in transit and at restClassification and DLPBackup with immutabilitySecrets managementPatch and vulnerability management
Detect
EDRIdentity threat detectionSIEM with tuned detectionsDNS and network telemetryCloud control plane auditing
Respond
Incident response plan and playbooksContainment tooling and authorityForensic readinessExternal retainer and legal contacts
Recover
Tested restore proceduresClean room rebuild capabilityDisaster recovery planPost incident improvement loop
Design considerations
- Anchor the design to a framework, NIST CSF, CIS Controls or ISO 27001, so coverage can be assessed consistently.
- Prioritise controls by attack path impact rather than by product category.
- Ensure every control has an owner, a monitoring method and a failure mode.
- Design for the assumption that prevention will fail somewhere.
Security considerations
- Protect the security tooling itself: separate identity, MFA, restricted administration and tamper protection.
- Validate controls with purple team exercises and attack path analysis rather than configuration review alone.
Failure points
- Detection dependent on a single telemetry source.
- Response authority undefined out of hours.
- Backups within the same identity and network blast radius as production.