Secure Architecture Assessment, Design, and Implementation

Definition of Secure Architecture Assessment, Design, and Implementation

Understanding how to assess, design and implement system architectures and workflows that follow security best practices and do not create unnecessary risk. This includes network architecture, software architecture, and cloud architecture. Security Engineers are responsible for integrating security tooling into existing environments.

Assistant / Associate:

Familiar with several common system and application architectures and patterns
Understand how to deploy basic applications in secure ways

Senior Associate / Professional:

Able to review architecture diagrams and find potential security problems and bad patterns
Creation and maintenance of architecture diagrams for security services.

Senior Professional / Principal:

Recommend ways to architect secure solutions that fit design requirements.
Understand correlations between efficient and secure architectures.
Recommend mitigating controls where necessary on existing architectures.

How to Develop Secure Architecture Assessment, Design, and Implementation

Training Courses:

· SANS SEC530: Defensible Security Architecture and Engineering

· SEC545: Cloud Security Architecture and Operations

· BYU IT 515R Cloud Architecture and Security

Online Videos:

· https://www.youtube.com/watch?v=4TxvqZFMaoA

· https://www.youtube.com/watch?v=qkfmj6WJBwA

· https://www.youtube.com/watch?v=Q6yFqLmlcGo

Experiences:

· Review architecture diagrams for systems you are responsible for and consider what weaknesses they have and how to improve them.

How to Demonstrate Secure Architecture Assessment, Design, and Implementation

DO:Describe what you did in completing / achieving your development plan

· Review architectures for existing systems.

· Plan ways to improve them.

ASSESS:Share, if applicable, any assessments that were taken / provided related to your activities

· Do architecture diagrams match what has been deployed?

· Are there common patterns for network or software architectures that encourage security?

LEARN:Explain what you felt that you were able to learn during your journey / experiences

· Describe when mitigations are sufficient to reduce built-in risk to acceptable levels.

· When is it worth tweaking existing architectures vs starting over?

APPLY:Give specifics examples where you have / plan to make direct application to your work

· What architectures are you responsible for, and what’s a timeline for improving them?

REFLECT:Review / consider things you would have done differently had you had this experience earlier

· How do people view software/network/system architecture? Is it something that needs more attention?