◇ OpenCyber Academy
Doctoral research · Chapter 2 · English

Chapter 2 — Security architecture and engineering: research frontier

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Security architecture and engineering: research frontier

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Bodies of knowledge"]
  N2["2.2 Principles, frameworks, evidence"]
  N3["2.3 Zero trust as a case"]
  N4["2.4 The gap and the contribution"]
  N5["2.5 Judging practitioner evidence"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Bodies of knowledge"]
  N2["2.2 Principles, frameworks, evidence"]
  N3["2.3 Zero trust as a case"]
  N4["2.4 The gap and the contribution"]
  N5["2.5 Judging practitioner evidence"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Bodies of knowledge]
    |
    v
[2.2 Principles, frameworks, evidence]
    |
    v
[2.3 Zero trust as a case]
    |
    v
[2.4 The gap and the contribution]
    |
    v
[2.5 Judging practitioner evidence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) map the main bodies of knowledge in security architecture; (2) separate principles, frameworks and empirical evidence; (3) locate the gap Amara's study addresses; (4) judge evidence quality in practitioner literature.

2.1 Bodies of knowledge

Amara's literature map has four regions. Principles start with Saltzer and Schroeder (1975), whose design principles such as least privilege, fail-safe defaults and complete mediation still frame architecture reviews. Engineering standards include NIST SP 800-160 Vol. 1 Rev. 1, which treats security as a property engineered through the system life cycle. Enterprise frameworks include SABSA, described by Sherwood, Clark and Lynas (2005), and The Open Group's guide on integrating risk and security into TOGAF. Practice books include Shostack (2014) on threat modelling and Anderson (2020) on security engineering, which combines principles with many case studies of failure.

2.2 Principles, frameworks, evidence

These sources are different kinds of knowledge. Principles are reasoned arguments about what tends to make systems safer. Frameworks such as SABSA and TOGAF organise work and vocabulary, which helps teams communicate but does not by itself show that outcomes improve. Control catalogues such as NIST SP 800-53 Rev. 5 and ISO/IEC 27002:2022 list safeguards. Empirical evidence is a fourth category: observations that a practice changed outcomes in real organisations. Amara finds the fourth category thin. Many papers describe a method and a single case, but few compare outcomes with a credible counterfactual.

2.3 Zero trust as a case

Zero trust architecture, described in NIST SP 800-207, shows how fast a frontier moves. The publication defines tenets such as authenticating and authorising every request and not granting trust based on network location. Vendors and governments adopted the term rapidly, yet Amara finds little peer-reviewed evidence measuring how zero trust deployments change incident rates. This is not a criticism of the guidance, which is a design reference, but it shows a recurring gap: architectural ideas spread through standards and practice faster than research can test their effects. Her own study sits in that gap for threat modelling.

2.4 The gap and the contribution

After screening, Amara finds studies of threat-modelling usability, studies counting threats identified in workshops and practitioner reports of adoption. She finds no study in her search that links a threat-modelling step to post-release architecture defects with comparison teams. That is her gap. She states the contribution narrowly: an estimate, with uncertainty, of the effect at one organisation, a reusable coding manual and a replication package. She avoids claiming that threat modelling works in general, because one organisation cannot support that claim, and she lists the conditions under which her estimate might transfer.

2.5 Judging practitioner evidence

Much architecture knowledge appears in conference talks, vendor reports and blogs. Amara grades each source on a simple scale: does it report how data were collected, does it include a comparison, does it report failures as well as successes, and does it disclose conflicts of interest. A vendor survey claiming large reductions after adopting its platform scores low on comparison and conflicts. A team's honest post-incident review scores higher on transparency even with one case. She uses low-graded sources only to generate hypotheses, never as evidence of effect, and states this rule in her methods chapter.

Worked example

Amara builds a four-region literature map, classifies twenty sources as principle, framework, catalogue or empirical, grades practitioner reports and writes a narrow contribution statement.

Synthetic case. The screening counts and graded reports are synthetic; the cited works are real.

Errors and limits

Literature searches miss grey literature and non-English work. A gap may exist because a question is hard to measure, not because nobody thought of it.

Exercises

Synthesis

The frontier in security architecture is rich in principles and frameworks but thin in outcome evidence, which defines where doctoral work can contribute.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →