Chapter 18 — Security architecture

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Layers"]
  N2["18.2 Environments"]
  N3["18.3 Governance controls in architecture"]
  N4["18.4 Review"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Layers"]
  N2["18.2 Environments"]
  N3["18.3 Governance controls in architecture"]
  N4["18.4 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Layers]
    |
    v
[18.2 Environments]
    |
    v
[18.3 Governance controls in architecture]
    |
    v
[18.4 Review]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) design layered protection for data platforms; (2) separate environments; (3) place governance controls in the architecture.

18.1 Layers

Kofi designs a security architecture for Tidewater's data platform with layers: network segmentation separating the control system from business systems, identity and access management, encryption at rest and in transit, logging and monitoring, and data-level controls such as masking of customer identifiers. He explains that layers mean a failure in one control does not expose everything. The architecture is reviewed by the security team and data governance lead together, since each layer affects both. Each layer has a named owner and a test schedule.

18.2 Environments

Development, test and production environments are separated. Kofi finds that developers have been copying production customer data into test environments to reproduce bugs. He proposes a synthetic data generator that produces realistic customers, premises and readings with the same statistical properties, plus a strict rule that production personal data never enter test. NIST SP 800-188 discusses synthetic data and de-identification approaches, which he uses to judge what properties the generator must preserve. The generator is itself tested to make sure no real records can be reproduced from its output.

18.3 Governance controls in architecture

Kofi places governance controls at specific points: quality rules at ingestion, classification tags on each data set in the catalogue, access policies enforced by the warehouse based on those tags and retention jobs that read tags to decide deletion. He argues that controls tied to metadata scale better than controls written into each application. When a new data set is tagged as containing personal data, protections apply automatically rather than depending on someone remembering. Tag changes are logged and reviewed by the owner.

18.4 Review

The architecture review raises concerns about performance of masking on large queries and about who maintains classification tags. Kofi runs a test showing masking adds acceptable delay, and proposes that data owners approve tags when data sets are registered. Prof. Varga notes that architecture is a set of decisions with trade-offs, and that recording rejected alternatives, such as encrypting every column individually, helps future engineers understand the chosen design. The decision record lists that alternative, its cost and the reason it was not chosen by the review panel.

Worked example

Kofi designs layered data platform security, replaces production data in test with synthetic data, ties access and retention to classification tags and records trade-offs from review.

Synthetic case. The architecture is synthetic; NIST SP 800-188 is real.

Errors and limits

Tags are only as good as their maintenance; audit them.

Exercises

• EX052 — Test data rule. What rule did Kofi propose for test environments? Rubric: 3 = production personal data never enter test;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX053 — Tag-driven controls. Why tie controls to metadata tags? Rubric: 3 = protections apply automatically and scale;; 2 = mentions automatic;; 1 = vague;; 0 = none.
• EX054 — Tag owner. Who approves classification tags? Rubric: 3 = data owners at registration;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 18 (chapter 18 of 50)

← Chapter 17 · Course chapter index · Chapter 19 →

Continue to the next authored lesson.