Application and Software Security Architecture
This domain tests secure design and the software development lifecycle: threat modelling at design time, assurance tooling across the pipeline, and service-to-service security in distributed applications. Expect questions that force you to pick the control that actually removes the flaw.
Threat modelling
Model the data flow diagram, not the org chart. Apply STRIDE per element and at every trust boundary crossing: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege. PASTA is risk-centric and business-driven; LINDDUN covers privacy; attack trees quantify paths. Threat model at design and revisit on architectural change.
SSDLC gates
Requirements → design review → implementation (SAST, secrets scanning, SCA and SBOM, secure code review) → build (artifact signing, provenance) → test (DAST, IAST, penetration testing) → deploy (least-privilege pipeline identity, environment separation, no production credentials in CI) → operate (RASP, WAF, monitoring). Every gate needs a documented waiver path and an owner.
Architecture patterns
Server-side input validation, context-aware output encoding, parameterised queries, authorization enforced in the service rather than only at the gateway, short-lived tokens validated for signature, issuer, audience, and expiry, mTLS or signed service identity between microservices, rate limits and quotas, idempotency, safe defaults, pinned dependencies.
Worked example
Checkout flow: browser → API gateway → order service → payment service. Reasoning: mark each hop as a trust boundary. Spoofing - tokens stolen from the browser, so shorten token lifetime and rotate refresh tokens. Tampering - the client sends price, so recompute it server-side. Information disclosure - PANs land in logs, so tokenize and redact. Elevation of privilege - order IDs are enumerable, so enforce object-level authorization. Denial of service - no checkout rate limit, so add per-user and per-IP quotas. Record residual risk and the monitoring for each.
Traps
- Threat modelling only after release.
- SAST as the sole assurance activity.
- Using a WAF as the fix for injection.
- Not validating JWT algorithm, audience, and issuer.
- Trusting client-side validation.
- Producing an SBOM with no vulnerability response process.
- CI pipelines holding production administrator credentials.