Security Architecture and Engineering
Security Architecture and Engineering tests secure design: how components, trust boundaries, and failure modes combine into a defensible system.
Core rules
- Secure design principles: least privilege, separation of duties, defense in depth, fail-safe defaults, complete mediation, open design, and minimizing attack surface.
- The trusted computing base (TCB) is the set of components relied on for security; smaller and simpler is easier to verify. A reference monitor mediates every access, is tamper-resistant, and is small enough to analyze.
- Threat modeling identifies assets, trust boundaries, threats, and mitigations; STRIDE is a mnemonic for spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
- Virtualization and cloud add shared responsibility: the provider secures the platform, while the customer secures identities, data, and configuration unless contract says otherwise.
- Fail secure for physical access; fail open may be appropriate for life safety, but must be an explicit risk decision.
Worked example
A mobile app talks to an API and a payment service. The threat model draws boundaries at the phone, API gateway, and payment provider. Spoofing is mitigated by OIDC authentication, tampering by TLS and signed requests, information disclosure by field-level encryption and least-privilege tokens, and elevation by server-side authorization checks. Each mitigation is tied to a boundary; a control inside the phone cannot protect the API from a modified client.
Traps
Do not assume encryption removes the need for authorization. A larger TCB is not stronger. Fail open is not automatically wrong-but undocumented fail-open is. Cloud provider compliance does not make the customer’s configuration compliant.