Security Architecture
Cloud, virtualization, and specialized systems
Learn IaaS, PaaS, SaaS plus deployment models (public, private, hybrid, community). In the shared responsibility model the provider secures the physical layer and the service's own infrastructure, while the customer always owns data, identities, and configuration. Containers share the host kernel and are lighter than VMs; serverless removes host management but leaves code and IAM to the customer; microservices and APIs enlarge the attack surface. ICS, SCADA, and IoT devices often cannot be patched, so network segmentation and compensating controls are the expected answers.
Network architecture
Segmentation, VLANs, DMZs, NAC, and jump hosts limit lateral movement. Zero trust architecture replaces perimeter trust with identity-aware policy. Memorize the ports that appear in scenarios (22 SSH, 53 DNS, 443 HTTPS, 445 SMB, 636 LDAPS, 1433 SQL, 3389 RDP) and their hardened alternatives: TLS for data in transit, IPsec for site-to-site tunnels, SSH instead of Telnet.
Resilience and recovery
High availability comes from load balancing, clustering, and redundant components. Backups differ in restore effort: full, incremental (fastest to make, slowest to restore), differential, snapshots, replication. RTO is how long you may be down; RPO is how much data you may lose. MTTR measures repair time, MTBF measures reliability. DR sites run hot (near-instant, costly), warm (partial), or cold (space and power only).
Data protection
Match protection to data state: at rest (encryption, masking, tokenization), in transit (TLS, IPsec), in use (secure enclaves). Hardware roots of trust include the TPM for device keys, HSMs for high-assurance operations, and cloud key management services.
Rule of thumb: RPO dictates backup frequency, RTO dictates the recovery architecture.