Chapter 2 — Security architecture and engineering: advanced seminar
Lesson map
Lesson 02 published. Map, example, EX008.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Three views of architecture"]
N2["2.2 Principles behind segmentation"]
N3["2.3 Critiquing a framework claim"]
N4["2.4 Evidence in seminar argument"]
N5["2.5 Seminar output"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX008"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Three views of architecture"]
N2["2.2 Principles behind segmentation"]
N3["2.3 Critiquing a framework claim"]
N4["2.4 Evidence in seminar argument"]
N5["2.5 Seminar output"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]
[Learning outcomes]
|
v
[2.1 Three views of architecture]
|
v
[2.2 Principles behind segmentation]
|
v
[2.3 Critiquing a framework claim]
|
v
[2.4 Evidence in seminar argument]
|
v
[2.5 Seminar output]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX008]
Learning outcomes
You will (1) compare enterprise, systems-engineering and threat-driven views of security architecture; (2) relate design principles to segmentation; (3) critique a framework claim; (4) present a seminar argument with evidence.
2.1 Three views of architecture
In Dr Aydın's seminar, Kenji meets three ways of seeing security architecture. The enterprise view, represented by SABSA and The Open Group's TOGAF guide on integrating risk and security, starts from business attributes and traces them down to controls. The systems-engineering view, represented by NIST SP 800-160 Vol. 1 Rev. 1, treats security as an emergent property engineered across the life cycle with explicit assurance cases. The threat-driven view, represented by Shostack (2014), starts from what can go wrong in a specific design. Each view asks a different first question, and good architects move between them deliberately.
2.2 Principles behind segmentation
Segmentation applies older principles. Least privilege says each workstation should reach only the services it needs. Complete mediation says every access should be checked, which SP 800-207 implements through policy enforcement points. Separation of privilege suggests that sensitive access should need more than one condition, such as device health and user identity. Economy of mechanism warns against policies so complex that nobody can verify them. Kenji notices that the last principle pulls against the others: finer segmentation enforces least privilege better but creates more rules, and every unmanaged rule is a potential gap.
2.3 Critiquing a framework claim
A seminar reading claims that adopting zero trust eliminates lateral movement. Kenji critiques it. SP 800-207 itself describes zero trust as a set of principles and a journey rather than a single product, and it acknowledges threats to zero trust deployments, such as compromise of the policy decision point and stolen credentials. Lateral movement can continue with a valid identity on an allowed path. The fair claim is narrower: zero trust can reduce reachable paths and make movement easier to observe. He presents this distinction with direct quotation of the publication's threats section rather than paraphrase from secondary sources.
2.4 Evidence in seminar argument
Dr Aydın asks every presenter to tag claims as principle, framework guidance, case evidence or measured result. Kenji's slides carry small tags. When a classmate claims that micro-segmentation always reduces incidents, Kenji asks which tag applies, and the answer is principle plus vendor case studies, not measurement. The exercise is uncomfortable but useful: it shows the class how much of architecture practice rests on reasoning and experience rather than measured outcomes, which is acceptable as long as it is stated plainly and not dressed up as proof.
2.5 Seminar output
Kenji's seminar paper argues that segmentation strategies should be compared on reachability and on rule complexity together, because a strategy that reduces reach but needs thousands of unmanageable rules may fail in operation. He proposes measuring both in his dissertation. The class challenges him to define complexity; he chooses the number of distinct allow rules as a simple, imperfect measure, and lists its weaknesses. The paper becomes the conceptual chapter of his dissertation, and the challenge from classmates becomes one of the competing explanations he will test later.
Worked example
Kenji contrasts three architecture views, maps four Saltzer and Schroeder principles to segmentation, critiques the claim that zero trust eliminates lateral movement and proposes measuring reach together with rule count.
Synthetic case. Seminar participants and claims are synthetic; SABSA, TOGAF G152, SP 800-160v1r1, SP 800-207 and Shostack (2014) are real.
Errors and limits
Rule count is a crude proxy for operational complexity. Seminar tagging can oversimplify mixed evidence.
Exercises
- EX008 — First questions. What first question does each architecture view ask? Rubric: 3 = enterprise: business attributes; systems engineering: life-cycle assurance; threat-driven: what can go wrong;; 2 = two;; 1 = one;; 0 = none.
- EX009 — Principle tension. Which principle pulls against fine segmentation, and why? Rubric: 3 = economy of mechanism, because finer segmentation creates more rules to verify;; 2 = named;; 1 = vague;; 0 = none.
- EX010 — Zero trust threats. Name a threat to zero trust deployments acknowledged in SP 800-207. Rubric: 3 = compromise of the policy decision point or stolen credentials;; 2 = one;; 1 = vague;; 0 = none.
- EX011 — Fair zero trust claim. What is the fair version of zero trust eliminates lateral movement? Rubric: 3 = it can reduce reachable paths and make movement easier to observe;; 2 = reduced;; 1 = eliminates;; 0 = none.
- EX012 — Evidence tags. Which four tags does Dr Aydın require on claims? Rubric: 3 = principle, framework guidance, case evidence, measured result;; 2 = three;; 1 = one;; 0 = none.
- EX013 — Complexity measure. How does Kenji measure rule complexity, and what is its weakness? Rubric: 3 = count of distinct allow rules; crude proxy;; 2 = measure;; 1 = vague;; 0 = none.
- EX014 — Dual outcome reason. Why compare strategies on reach and rule count together? Rubric: 3 = a strategy can reduce reach but be unmanageable in operation;; 2 = both;; 1 = reach only;; 0 = none.
Synthesis
An advanced seminar trains the student to move between architecture views, tie designs to principles and tag every claim by the kind of evidence behind it.
Continue studying — chapter 02 of 08
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →