Skip to content
sec/atlas
back to the map
concept
stage: design
2 min read

Security architecture principles

A security architect designs the controls once, as patterns, so that hundreds of teams inherit them. The craft is a small set of principles applied consistently across cloud, network, identity and data.

threat modeling (STRIDE)architecture decision records (ADR)SABSA / TOGAF (optional)reference architectures and landing zonesNIST SP 800-207 (zero trust)C4 diagrams

Core principles

  • : every identity and workload gets only the access its task needs, for as long as it needs it.
  • : several independent layers, so one failure is not a breach.
  • : never trust by network location; authenticate and authorize every request, using identity, device and context, and assume breach.
  • Secure by default: the easy path is the safe path; insecure options need explicit effort.
  • Separation of duties and of environments: no single person or compromise should be able to do everything.
  • Minimize and : expose less, segment more, and limit what one failure can reach.
  • and keep it simple: complexity is the enemy of security.

From principles to patterns

Principles do not scale by themselves; patterns do. A landing zone gives every new cloud account the same logging, network baseline and guardrails. A standard identity service gives every application authentication and authorization. A paved path for pipelines carries the security checks. The architect's output is these reusable building blocks, plus the guidance for when to use them and a process for exceptions.

Recording decisions

Write down significant decisions with their context and trade-offs. Short architecture decision records keep the reasoning findable when the team changes.

adr-0012-service-to-service-authentication.mdmarkdown
# ADR-0012: Service-to-service authentication uses workload identity (mTLS)

Status: accepted   Date: 2026-10-02   Owner: security-architecture

## Context
Services call each other inside the cluster. A network allow-list is the only control today; a compromised pod can call anything.

## Decision
Every service gets a workload identity and mutual TLS through the mesh. Authorization policies state which service may call which endpoint. Default is deny.

## Consequences
+ Compromise of one service no longer grants network access to all.
+ Calls are attributable in logs.
- Teams must define their allowed callers; the mesh adds operational complexity.

## Alternatives considered
Network policies only (rejected: no identity, hard to audit); shared API keys (rejected: no rotation, no attribution).

Working with teams

  • Review designs early, when change is cheap; use threat modeling on new systems and major changes.
  • Give teams self-service patterns and guardrails rather than approval queues that slow them down.
  • Explain the risk behind each requirement; rules without reasons get bypassed.
  • Track exceptions with owners and expiry dates, and feed recurring exceptions back into the pattern.
  • Measure adoption of the patterns: an unused reference architecture protects nobody.
Least privilegeleast privilegeThe principle of giving each identity only the permissions strictly needed for its function, and nothing more. It is the opposite of 'admin user by default': every extra role is one more path an attacker can use after a compromise.see in glossary →Defense in depthIndependent layers of protection, on the premise that any one of them can fail: validation + parameterization + WAF + monitoring.see in glossary →Zero trustA model that starts from the premise of trusting no one based on network position: every request is authenticated, authorized and logged, even when it comes from the internal network. It replaces the castle-and-moat with continuous verification at every door, human or service.see in glossary →Attack surfaceEverything exposed to untrusted input: endpoints, forms, dependencies, ports, pipelines. A minimal surface is a defense strategy.see in glossary →Blast radiusblast radiusThe size of the damage when something breaks: one account, an entire region, a tenant. Good cloud design limits the radius through isolation (separate accounts, separate VPCs, narrow roles) so that a failure or an attack does not become a full-blown disaster.see in glossary →Fail closedfail secureWhen a security check cannot decide (timeout, error), the answer is deny. The opposite, failing open, turns every outage into an access-control bypass.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

test what you learned

Loading questions…