Chapter 18 — Security architecture | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Security architecture

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Identity as the control plane"]
  N2["18.2 Decision and enforcement points"]
  N3["18.3 Placing controls"]
  N4["18.4 Simplicity"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Identity as the control plane"]
  N2["18.2 Decision and enforcement points"]
  N3["18.3 Placing controls"]
  N4["18.4 Simplicity"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Identity as the control plane]
    |
    v
[18.2 Decision and enforcement points]
    |
    v
[18.3 Placing controls]
    |
    v
[18.4 Simplicity]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) place identity controls in an architecture; (2) centralise decisions sensibly; (3) keep the design simple.

18.1 Identity as the control plane

In Linmouth's target design, the identity provider becomes the central point where staff are authenticated and where many access decisions are made. Zero trust architecture, described in NIST SP 800-207, treats every access request as needing verification based on identity, device and context rather than network location. Sana does not adopt zero trust as a slogan; she uses its ideas to decide where policy decisions are made, where they are enforced and what information each decision needs. This keeps the design grounded in specific, testable decisions.

18.2 Decision and enforcement points

SP 800-207 separates the policy decision point, which decides whether access is allowed, from the policy enforcement point, which applies the decision. In Sana's design, the identity provider and its conditional access rules decide; applications and gateways enforce by accepting or rejecting tokens. Separating them means policy can change centrally without modifying each application. It also concentrates risk: if the decision point fails or is misconfigured, every application is affected, so it needs strong change control and resilience. The decision point is therefore deployed redundantly.

18.3 Placing controls

Sana places controls where they are most effective. Authentication strength is enforced at the provider, so all applications benefit. Fine-grained authorisation, such as which case records a social worker may view, stays in the application, which understands its own data. Lifecycle automation sits between HR and the directory. Monitoring collects events from all of these. Each placement is recorded on the architecture diagram with its purpose, so reviewers can see why a control lives where it does. Placement decisions are revisited if requirements change.

18.4 Simplicity

Every extra identity provider, exception policy or special sign-in path adds a place for errors. Sana prefers one provider for staff, a small number of conditional access policies and consistent integration templates. She justifies any added complexity by a specific requirement, such as a separate arrangement for external partners. Simple designs are easier to review, test and operate, and operators who understand the whole design are less likely to make dangerous changes under pressure. Simplicity also reduces training needs for the small identity team.

Worked example

Sana's architecture places authentication at one provider, authorisation detail in applications, lifecycle between HR and directory, and monitoring across all, with decision and enforcement points labelled.

Synthetic case. The architecture is synthetic.

Errors and limits

Pushing all fine-grained authorisation into the central provider ignores that applications best understand their own data.

Exercises

EX052 — Decision versus enforcement. What does the policy enforcement point do? Rubric: 3 = applies the decision by accepting or rejecting access;; 2 = enforce;; 1 = decide;; 0 = none.
EX053 — Central risk. What risk comes with a central decision point? Rubric: 3 = its failure or misconfiguration affects every application;; 2 = single point;; 1 = vague;; 0 = none.
EX054 — Authorisation placement. Where does fine-grained authorisation stay in Sana's design? Rubric: 3 = in the application, which knows its data;; 2 = application;; 1 = provider;; 0 = none.

Synthesis

Clear decision and enforcement points, deliberate control placement and simplicity make identity architecture robust.

Continue studying — chapter 18 of 50

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →